From bee67c865ce861174fb08dd6af4d5022806d93e6 Mon Sep 17 00:00:00 2001
From: dhwanishah-crest <dhwani.shah@crestdata.ai>
Date: Wed, 30 Oct 2024 21:48:30 +0530
Subject: [PATCH] Infoblox Insight ID Bug Fix

---
 Solutions/Infoblox/Package/3.0.1.zip          | Bin 0 -> 146208 bytes
 Solutions/Infoblox/Package/mainTemplate.json  | 124 +++++++++---------
 .../Infoblox/Workbooks/Infoblox_Workbook.json |   2 +-
 3 files changed, 63 insertions(+), 63 deletions(-)
 create mode 100644 Solutions/Infoblox/Package/3.0.1.zip

diff --git a/Solutions/Infoblox/Package/3.0.1.zip b/Solutions/Infoblox/Package/3.0.1.zip
new file mode 100644
index 0000000000000000000000000000000000000000..7b774da6e92c7e2e00b489f5845a236adf0d7c7b
GIT binary patch
literal 146208
zcmV)RK(oJ4O9KQH0000800)U)Sq1v!7^w{a0CPD202crN0Aq4xVRU6xX+&jaX>MtB
zX>V>WYIARH?OSbc+{O|9UZDSBaV?;`!@bx_(-cOXK#}BFs1m!95~Gj|V~^as+la?y
zxJyZw)Ik15zxJo)m-Lxga>=`+WXrZ(I|&dt61kk6_kDI|^wS^zAVlZSHkzx2>^u;i
zxpSF)Fdq9SqlHZ6Of6LEM)JoZSEI-*%6E2rZ*+gOJ<M`-q1EMhH&@cBZx8m=RHxc$
zla9VF5~sggjJ~%f{ZnVad(CAUCn~4CzSdE0teLve4%2Q>C>LL-+=37-UfHaCoylA-
zl*1yd_=z6jVPw*&p4AWVNZV)nN14ZXIF*T2gYae|t&SRB^TSx#DA$=QcmBIx%!JLO
zhi5@Mxx5_Bw3`=`!m1oQI?@p7h9&X;4v+Crrz#mkSzvN}XlBNabviYZ#9X~d@axE4
z%+5OEQpau%`k#H8UE$Zc(zCe>zkhy~o~8Z%H^!+4{l0jbC~1|*)l}ue8R6ziOihxQ
zOP$WdL`_YugifuKNkUKPy){We@;nek>zAMZD~?!^D=)?Ak@B=@EBm}#iR(qZUOtyA
zRS9`q60_rjQqXZpm5GiPagSIK#KXy4fz^dvf@^Vlo|?;4Xlsk+-trt?XvenPtK!x2
zYQMNAGL<_CuOn$mA=-+HkAcWG^|jbk(}=hNL!x3kP=IoC5qwotQiD?gPtmhf#Y9%6
zaP3I3MkATYiB1p&$_g{ZH&Kymw-isnsbv1eF6h8>Mfdp0Zcj{>;KivKy@eDqqD69&
z5Q|QM!<i!D2p+-icI670h*Y^tlb?%NItgZSeF0vkxmk$4Z;t&_d~RB}A3^yLAnXY-
zv)o*0NF=}zHj>HGIt$lybC$^&lUVv`iEX{eKNLDTPr!LhRHsX3FIP4*DZkHPal8Pd
zZcedng)O4FkQO#iE+zC&A26HhYN`|GIT;AOU}m5QgA@P*30r9}GuBbE5YLD)tK=e4
z)(Ri>MJWoAg=hr~aG|h)olgwn-wsy&U8NSJNGRz9Lf+{}Hnvh1;NA-2b77Fu;4pD%
zfjn0Ua#cKlb>UVUCWBkdT}jv?JisNiUaA3>a*9_s6lNjPS-Pfr2tH9M5~}l7CGKUG
z{qpmFz!p2$lJ)E@cb#WIpJ|j7F>y)x%4;3*PY&f=t|w)rfIU;p=Hf!;+7wnK#+(<K
z<@FcZf-cf1d+$hmxfBT$l*<{DP4y3jBCi`FrIL4eNt@0)5E48%P@Q>_2IA!2{MHnC
zq+p*Qd?ZtnCoUq$&Z&jJSy0p}=saT6>hwZcr)L#cCk^wmmZnAO?c#%R5Im4HeNfry
z2?XJENLx_o?6c_yLM<|L$y=9fLEG?xf;5Lyj9A0&kR0(lHBn*NXVZp<lwLFtbQUh~
z1o47|#Kr(I@9DH`I@OVeo_rMHY4DL5Qk!+)MdhsQGMG4H_4{9X2eJMBS$cmY`u(Fe
z{y2==UDVsWsgHjDfp|pHkSOGH3j|#qAWYetuqI<}<>%YP=p%2|RU3LvukmDJ?4M=Q
z2`UaNNW2T5bD79y`tkMwTT&;``Az<PmVQD!e!K42;dnUlG9HkJ6JI+K92i@qgi4YG
zXI^}BJTwoDkaJ=cX@We%g*@l1l7?>=x>6ExN2cGS(AhO<3N4%55;*vD0H&YH9AVDC
z|CN4!2JK8BD?iz$Cp+ZNu%<XFkUqoXr-@vKh4(+BT}}^`%u^qCa$*YCa+qwK){GUa
zBfBU5EjFnHoN)8U;k=Jc)bp^fL}|8|G+|l;z~Lnba7KCRGb01U)8-1%grD`P{B^*)
z<FIpc*Xur%NfkR|az&d-IK#Ni%Q<ACkYQclKy8Hto8gAV0Fyf6l~W);+i5O*UjOp4
zsj|dGvQ=FG(URh8{RQE59piK-9Q;^w(yE9I#HA851)pvlPRQ*(SHiatg_SB+xNEXR
z7$5$Qj8tLsYgn%g`W3QOw!uH*&0OwZX{3>qpufwDCZX!b@`s9WjsAmcG_L_E?iM6B
zWIWt?7DQ=s<(3&Qsm&7HdbE=-b~26Vbh$}ZzXFmv(IiEOK^P$)LV`F$YUlCTL6J<z
z8m!!-QU`*SfSi#a?p3@(n~qGrd=d528Q-Y#Zlcnen|D`~*zJu-!rtIs@A(ReTp{CG
z*XAU1LwBgoSNkWco{5{7oAZv?AMVj@1}8Ss@nEYF4X+zOU&u@k%RAu1?R(qzhWGw9
zymx;K47XW#aFZ1;U(<lQW&yA_+RIJ0ha1Mq>O@XdLd)B|AxrRNZW72yi;meoLN>zS
zCNGGwV@x+7hJ6Xy-K03@!q*Ltu(xyx9L>NG&b9}RiocTyOwI;e$gJxfvg^a6yR{ks
zTfNZ*Egy(-T~9pxoDXb*DP3m{2{D!LVEG<!W%;bt|9V)^)lMy#4h~PNx}_Iw{dDGa
ze%5(#*4YA%#WMbCAhymrgR>5E(*E}47D%sncIn$10B$o!G&NSIq~@a1(Vkb?1K=fl
zW%8h`8if<O-J8~q@s&lBM8@hwJLcxbl`uV>TN@|cdO~mK?EaAO*2Z~rZG4<y^_Msb
z&Nn_W9P}Hm=E>0>mBWYob$JQr%cZ{#1itw0T|usq_?Id8VnD}E0Aj$Y4#y82J>`v8
zEa7HtSN0G~Be65}*t4}vG6?rce??UuG;?8LjX?(fRq<t3=$P>wc<@l7zHHL{VzhD)
zHgeax3%;(|wm)98d5)^e$l-6%dY^o}*8437-CsUlv;7`)_S4_3_Yue5kO5-;o^7aF
z0#JIantNCdfSp<d;KD~Hbb~7t>OMEs;6;k{RCA)DJ^ko>0dwPVX%5^Fm7@e&mA;4{
zbQfYxHE0kOqyTO>@V0y_uU|F`tyFu8sa*il@z9we{wGkDL5l}3tExJc_S3pHRTjY^
z+d#|<l3~WBWiJ1(mhn~!e!@l&03~I<wzTvj-no;&zt6Yt+C6BKwiiukzftxondCBL
z!yfA!GZkpP*^)&C4DGYPJ9Xo@R2F(;<C6H0C=V;j>x5t4r0n{a=dXXQ-Y8YAUX(Xq
zqdIU{u2{W}qP>f&C{jvQ!PpI1iK6P7x>$#LLaX2HnY3ASdU^eos-45zUZw(P@BeVI
z8=0wMri;!f;(V@>jKG<oK0;lw=cL4qJr>sGR8miT{otB7eHDJgW3(K6k-cfJJ3Jj~
z#dA1*P$B<rg4z|7b7e9t)9;XQHi!7_Li<+gy#M-|#0`$4ZvBIxkN`dpx!oeFh}-z$
zx}a-exSi?N;Cn+qc$F_~AcX70to!OPE)v`vU1#6AT<gG9-6#r<vH{CSgg?~l7Vg2*
zfq0CJHxS<*9pXoHx2bO$i~R-KTIdR%G(&HS3NSahW3G;)AnD`;HD@3>L@O=_bsvn{
zO7!j4$-&<K7Og`&Dgm#kO$TlnRMbr{tSo!Xmvi*gIPACfjI~<jo`jsC3Jp}iGI%`0
zLls0v3cx001t1pR3<luL(fmXjSyo3Qb7h2?P<^rP-Bk>sM@w@QyfHwLx{wvr2?@?-
zXsS&$!6~hh*mnm(OG&hX!J?NNsg$ds)FmW|sXJHpWF3GIBp?P!&)nenQPmC6hFt3@
zttBis9z1{ZINiRBIK8s~ZLe0n_W%u%NhYs7s_I)&zZkW7AFikbBjl{U;;?zJ(k34W
z4^J8om{Z^Q9hCn(-bK6~(|iH0Nhos-#14-^kS8^J$YocUobdo1HRUj6S7rc?6|WCJ
znSky*-wV3C`;U5lprSDbf@3(1G48@Q2tTjVns_)ss^)n>`8=5s8luF`ei<iz!htRr
zX%$luO~+uGqMEAM7}p_SfhNL0Olr-DvcrU@^jqDw_uAqx^gTvAsZyaWHAuqxbVrxc
z#YCs!9^}VMa)s+r8RTtk_YmzNMOL?~5blkePBo0dOwz1c)gPt}TXhH3aW<f>-Z~lF
z8jpwOYdapV`u^_*kGF32mUz6K!`tHVz}bg@$5#h5E7nAgaR7kt1=@x*82QTLDED%k
z)tMDa_6|XIt<7IO$o3;k!*XC~=*!$+JUbaJq8B=T_|#y~G#Lg-U+^UCi{|9=y9ec!
z`tJmk51U7t*kkdLriWtZ=>e)<1i{`J4hVw$-*7-Z+}jY^+uYxJ`7HIwlV-xCINCox
zAzh5bF8cxwRn)WQn6aZ69fTs6pCTiVEJtfOyknK2vc@N7s2BQyFn;n6A}Jn~Gm3PE
z`$0CGMOT^U32=nK$!Wh|@m{js@4x<lHa?r&FrZz|i;dTI7%fo-?7b&MTlvQJdv)^N
zz1_QV^6ihv$?N{m-tLFv=wRjrM5w1y@66%Xc6wKie{1xXRr8na=q-$Az7zD;y4hQz
zw{{M1i{1if9}0S_#H!(1D6C?D+e_#B-}PU5<aB=vf6=f5fKgUHD145p)=2mG$<9%4
z<-+v}9EjiWUHP{G6nBYPB5sNlV`nv^CxOv&QmnxMo9wz0FK)_9?i+)6=n493q`&->
ze_%p1+u$bArJ+aC$YX@)+oR9g8-DfZv;5nc06#0y?+$>rrKq(zH?*y?Vs&<~o~9f&
zW{NwfQ=MDaeZvt#xEKxoz3CX?07V515LaLD9ALG5V3%eBSLO|QX0VcBWnQp3E!{b-
ze(A0(sV6&WP0Mc8pepMW|KPv>0Z>Z=1QY-O00;ookzQF%^&y>kECK*?_Z9#V0001O
zVQFquWo>Y5VRU6KYIARH>|OhB<TjH2{eb%)2<NbVth;S>w_gEv4<64XF?KRDH+C{O
zI0KI?vAeZaONykn$H~qAepRHXCrPm%wiUoxAnQnEvA$w`MY71I{`}AXAY|je5@$+h
z_Qv;QW16N>^8MZ(f6|}Xfjyx!8l-*uk9kb{PB_cnC3}N?>!i0o>g`*5E{*)~0n1&|
zS>)R(?f*LogYPzWSp!ZOr10)n8Yf;DU^`ZSAODxVpV8EI?G!cm6Cc1Md!A0i7>k|<
z<M750zw)w7+6-Gt@a0A5&r^^|(yU!F4r7v6!5ZIq8<8E`&<?0jYQ+y7JLM{6kKkeY
z5K)w!q_G!FM6;--7rdpxB%Q)rt9b0vu|4<GUu}QR>RrV&3Fomxe~iO<w6)zAt$Z%a
zYCz6pB~I)`nNAz;!j#Mt>h6-8c}fCGUFwoFB$1sY#ExgZG`$7rNlL!F%^K-lOvAbF
z_MmF-747|G$F37XwJ&`_K2hQYNlI-OrIK_?$(Q>uzD*+Ap*^AI7ji%KoGI}V;?mf=
zgC@suIAg`%o|3%6hS2*P|KpqJpr%MO`_>J)u(__l(V)St&5v}#oFXLLGf5)+MD$HU
zdOea*^a^wu#3z)6$3AuNug%@UYqmDU`_1j`&+XVNkTuBE-ev^(lW30wpeXbHx8a1G
z2Dbl@dQJj;Nn=WW_MA9O!f{G2fI414eeB+Zrt?S(<t7YotsaVAt_uYdL8<U|9+6L(
z%yw3p!G9+}qjL&{TM-S`f#`Xl;QwV2?aq!p`^Kl`fOah${T&C`jGlRkQZybyEVl9z
zqQJR}@4QSvU;NRtqo@aZ_GZGTdP(L}%|^J4t6bHs&En1Gb{-Hn=H6KtjJ?UZYn8Qr
z4OW8}0niZ!gIs#8bXk1qRaw4U7IemkBeS+NHOuWPiYavvBIs8riT&^~3ry$kR$TnK
znG?7FKB6&;Kem4kH73(E*~_C%vbjsju_}K7!D^S3q+C#E9((CSE~26piYb9ofoBm=
zZlN~Q=xie94i^!1(0{FROjn@W-Q3fF+uUud-E*DZ=I%W3exFm${Vg*CY^zXYykg2*
z#U!U;sccg8Ar9TSle<)=Z))GtiXvs&>>li+=9{~luCvMhARNF22aw57R%cZ!?#`tc
z0q5<hx>ta&8K_|8piH@o_h+K3D(YOH{(LH9`#{b1K|9-*Xj&tvo&0K*gowW)`3G9^
z>rJDxNuB(Iu9AOXK>op^<gcLZDESA5<gXj3AnDMIfgjFg<R7ZZKWr!e5>0CawUb}1
zk`VD%B>zxLe!XdQHmQ?;*j4fm4ah%Sl>8O69VP$Jko<K66(k)QG4L&&*v^BD|06a3
zNA3Jyu62#9_7I@fN{IL?hJcYa1n5npvq?P!jJg^EMg}2Zv}g#ZpzUY~7#W6ux`7Iw
z9+XLV=7)2)qR8pYmJ$CzP5gs);xE#sMnXH?)w&1~e?__<Xz8vujm{=@x*v3v?gs{R
zKUkFR6|^0t`+*_d>jo03%UT|!@jh>;l7-`W;(Bg1uO!kWa@th5g2ih--fVhPrunnv
zq3&;VzA4qb!c4hYuUgPo!82`&;MB16OdFs+nFJ__#&vQmlL))NS(+Te*P6VL8LUBx
zy1VPyFlc2%B}=8@!C;*{7#Q*3Nm4Qk@}Qn<kd$cUK_w}rbjxK@G*9D}vcyc??`meU
zv;D!3bDzGy`8ULKWL>cxR(`KcXrr~t1)WOhu@C6L9UmX{#{14mZ*(x)?;Rgm2fdR+
zdSu-k?jN5VAC@GQ1?i)F!>dkx8mCxKI4rvRrb+vyj<2ckEMtHj*L~j*#dZaUtW#Es
zu6De%8|NF*sLN(1&IA*0aFaP42gvb#Q@ik>&4rt3S)~iJqVE1^Y@Hkqd+vB})Eimw
zuN#Xxy`eiivPQ@5;lT}6y09)l8@jMb`{pkEB;i})!e%HIaN%Vl@tR%O2ve&IgBcSV
z%i`}ff3-m5f!6X>?(4JbQi`kUA(>=-h}Ew@_Y(V#x);=rovCiJ2iT2N;u<|m#EqKn
zs!+N2foWNHRIa;jh~y=z({g<qIyV`p+{BRGB{#`hRk(*Pe68I*q^ii>!Vu@9xkV<%
z#2uu=P0bxD)BUP!of`~QZeX}`(sYB<B%#V!F?<GRkSQd02}8_}?GjvJ6US)o5H%fR
zC~=HR3p)20socXbtKM{vv+U5V!a+vQ;2?69<St@}`>|a_sBGdS%{_#slZ+%zQfou!
zCI>1vG0es`-Q>-k#z_vI!AWEa$z8+{^JBXRSJ=csnpx+jgB(a4q|$=UJq}gwacE|$
zrhA+Rt_O8+^Fi(+htJ?5Dy8IZVu<~*-K0?3#8nOrT;)*WDveg^?jp*QSAOW+l2hLg
z@5%WG@;aQ^UQm{(C?N!0w@WJL@bsn2`8?>n2i<mrcrTxzw`nb}UDmW&LZ+R5IrcW3
zcn<URG3ZfC=E@q7wD3I3D_@t)m1<r|=86)|8j@I%zjOxRL#9SE7b}C%$i>!Ou!i!+
zw}aax>wYNf(5=lIOdPO(mAyspmE=5dJQuVeuk3`n?QUGJV8}&DJLc4^Rn{=Iu~pKr
z^<V{va$#EH4&=nuEtD4{?!bt+PqP4CjJS<m7!`4sN!>jSab=q*b&sr}MAv(Tu6M?c
zqmazN<TXug&rgJR>WWk-*CMM<GEH#}t%j|%8ZM-`yt<Z1LphOjNruIUG&Ca8)1(a+
zBU1hNq>@O>oEd!@BFRpQ)_qVyq?@L*<qVR(YmQcu+R}lkR!&2fQ7c(SW;)92X<0Io
zvqYC^S&StkBbGc(=43IJ)K3^HS+dNr%BNw8>@a2B`BW^y<6P)!{1_IwjJ?T(#^mB5
za4O!YE7xRCi&QC-G<C|}D}3tBEJ`0v<Jf*+67h<Ft<9^?8Ul(Ohnj!~i$j*n(30^$
zPDWiuYcVn&7?JU5a#V|v@xYXf%N%-q8ZsWVld+Dn@VKAOK4iacuX<wXxrA)hT5@s~
zWi$*qY-Pw{yI%4-T1Fho8KFzyEyjpLBSt(;I&LvW9GWuXu(OOfY-dCrW$s}=(i9iq
z7ic~fkSqSzeA{G)RDzTvjglIs9JMm#$W&8#O)X!J<a{|=8()r$_;S=iz8snI<*2iK
zIcn!i9c9JOE@*t`ft%H@?P$J~v!z~NNtSX!4Ofm^xpHi%ro5t-D#voF9IuTk$3|2+
z?jTi;O{sF+S*jejQ>BhFceC>kr$5UkTjl3Xg4AkBxlt;kp~XonEl%3?lGo8P;zZ7f
zleID8#E20m9c09bDI-og%ZQV9M$}Q}9(M8mj89bLxo2&eCQ~%hq^wbt*X_UVw^E1~
zX=_8nCoVw03A?Y@h238prLYMDPGv2&(c)=I#dJ4fRaN~?(F#Gd@u~r|;dbvM8srIG
zf)|9yoU>U<O)jZKExj5wbObXv;b1L_K_Nm<G1WnbHJ)@ZJnGQNvkvBm9Xfp4!Q{9@
z9cabz&Sy~=V{jJ-jmTw_VbVf!f~n*w`6a8MqgVT}1Z%J$0EGlSyA-Dpto0p7u*}XQ
zSY14jU>ToCu)2FB!7@0L&;XkI-R1e~H?p--`FWE=wOUfzl*;Is(tgsw8n$busH7){
z;)H><z9R;f*%<??i-!y><5LDz^}9t5gL4KApfXpJ9A`5rrlpSQ5jk}g9kJR^C0L_{
zVJKwid8Rm{V6E?vf@O9}!Rq2M1<UxHg4NxF3YNi1g$7W)=ViZ8G38sexFPQvZJ6_~
zQdP&p_QMI*!P4*)vh;jZ98<8?cTT}FJE&lF@uY%fd{n{e?pX!P;IKjiXyJk0jDEC(
z31!}<JiMSOCgGn}rkr=mDmuQkA9b(}7lxsbq34<6@PoC!(+`%}@dvAm=N~NN0}xhs
zPe51(M<5zNbI-$k+D~DU$~Sb2H%&G*YAUyK^HMs_v>$q~nx`Hl`YEdEX`(puV6E@a
zgJpK=!Rq3%2g~@}gVo)G50=5nhbB<bWF6=dFq7qBUSv<2FdJow>}>{55d$*MIe%TI
zSMjjH{Oj!9HLoF~eO?=Rh4r&9!3ZYdM%@*c+x)Uk;oB`gq>bY64yLAYvX^yFekYMo
z8l>8hm%&HbgZ;sfe+sM@#q`dj_obqNB#>$E0xfSGkjh88Hm;=X%fB;Kt?1H-25#~`
zD9pm1KmSFn!tZV8)}GM%O{`__+b%ve^|?R>T?C4yUisTU8RW`0h4QG5_9jk#F8ba}
zr^P4J?s!L%%4dL>IQ$8n=$&dy<nccnmp7DItK@G=R}vAY;s{Jg(NPHGTlHlwPV!Dd
zF7eNw)&DH}dfQ;3A8N|pAitfpvh!6^putP4w?CBfGOw~ifT&(5ERnq|cXI)^Ucg3$
zA89~i&-vwCQbxswyg=^wzhpN@%gaGYuaPS#e{4#sBCD5rsb8Jv)qaU^=h@`rn~O`_
zS0!8X1O_Q`irgSS%menZxnx@*JDT74UNWU|S-zrdiT^*_@vR%)Gt*yADN$)=<1c0t
z@(|APdwJAOJpVz23Vd38PLby?SSYarSWbmW;?bBtU=bzvp!_Ryeex<7hLD*&Rsq^-
z7T;xRICemA^e47^X9p>S5)zI{!mf58e*<xGOnv4vyP!Sxd@$K%Dy7qy+9~mXB);!W
zXy8yn1Mr(EOR?bB)u;_Z{BY7&Sa1^C(e!`j;A}F+i+`lvga6>i-k?1(dH=!od{}wr
z8-FB)B`Jw<O-f?wQ2e^0ToESBr+~pN1YNV$?Db^`lLZ(zQccwxSn?u_2X*c1v$q@a
z`rj0CmxY}W)-><=g>dJyqYOeJ(iFQ|!sFo=)VQC9_?bmEek=jr<zlXx7*o8JN>2gN
z1G0IrU|a*tOw{5~vx<)oH}zc-d&%wUXhG67N?H`GsP_a|c{H`zFtIvbCheL@TNrbx
z?&IT*qd&-)Qa3@MVeGDf!65RQiM-B4E^2{>fTuLW`rt1Q`_bXz)IFgwEQZL;PVo|{
z)o~XxuQQp88lWlRNiDHP3#@?r(GkyV|K5hVIJ<Q?fg$^DxH|Mq=(P}feK%ax1`-jE
zZwwD6OfW-T!w@GVEec!Idm5~4X>(6+VBN8XNsN$q4HB<G;xgFF^&j5`6B@1#8-y&1
z6skNvI5${B7zZJXf`clL56(^_F-cn)Bgo38S&Kp~YCa9(bwFJP<D-L%(lrdYAY@T+
zP(=ey_V}~3g^k3XMLu02c~VPXub4ggy*2&uTR{E~OdhA?=7F6SU};7>g+@`8we@!k
zE|DH7|Hxb-CC8&pX*?4q;lw=U!Tgu|vI!vJi6Uq5>=;B&V`&^kLgJaR<Oz!<p_I}M
z&yA#<j#w5=HIeYlh?<FpC1J_31D(OPGNxz8B1sJ_2}-)0?+&`vQ9U~v*;0N<Sn}2P
zGvmuw=SzYrt*twNq_Xy20a0zm{LIL3MZF{#z9@cX{c+K}r2c%}`^@^6*2PQ0sH|x_
zfMx|4&#pf%YnRlYuS}QJU-nqBa7FblAEM<JtwCkeTeiurM(o>3imSel*=jaln`@S=
zV2k-|X2;$ilv#uP0|vdXTNT4>W3l@wg@MpZf)I~-r4Ovg_S(8z;MQ-jFM+*fdD}Jo
z^~LKlkedtO?xHO1wXcM<yhQFQ+VW=m3ScXX=+0uTZL+U|x4z8oDrV`n`U=413-Ruw
zUl-~wqm{0`SAnfq%>M=OuMKyX@hUdYR{*X`2z1o~<$d%OU{_KGUB+79H(wERBdO3;
z?AcEG3UEc*p{oe9?erB8io`@$5mtB6R{&Z|U33}m>Oi}UFxysN0ij5LJQ70LV?}~Q
z{DkAqOCQc+Sh>ZXy;QP9{MhI`$$o(%V5`k^XZv%iZi|&MOqaX`i@yyg!r)3fMsbKA
zKqVzDp=`bOKZ!jFw}!6Dz+laF`PL(uZGlY7i|MLm^ckBMYgNm%XMJ8QRxQ(-I(ji!
zwTw~j>BVT(GUj=!7t2-4wCBEFELJVEK-%oZbk#BjnYR~{Rm&`rvwN{!wM=W`@5Nx%
zGR9fM7sFM{=<<&*wyKuVWinrERV`zX41F<KwTv#U`eLhU8C`<5E4Gq7R%CbWJKOW^
z8_)Mr%s(s4xsjxHI>)T9rLf+Hmwd>snfjiLZ9k#1a`Il>h-f_X61=%eag7rzC2r&T
zkljJ0>nNpL5O!yjsBe7nmD*{l>c939yaDl&eoaw4L?4&kPIQlnb5bfu!hobxO7bQM
zo?MUV?{hDvuHuFw(Ow21YfSu>@RJawt(-Vvv_Ns8(Fc<*%IYw%P%4e*R3n>k`xq5;
zsZVp6>XK5=XD^iE*X=2L$rO6h{TF>$$!W^2l7@r}CAT1zU1g<l9ddO+DJ$TH&Kxhl
zV#=ZvpW1OiW+DDY;wGG@B@rn3^Om^G4{9d;S&kU*@ME|6@qhPbVc?}<yodMpfj01R
z0?qX9y}%9clkdWt)b@g2anGCQ_J9OEXk&XR&u%s56F9Z)WQUuV^+5Rxd02+_oOzOl
zGtEYu-gU)}B)@3xVt!Mc&(>L{c8<GQo8R^p-Us+Quh7RG$K3VM#bP?~k`#}w2gHsd
z-{Uv@5icm+`SvDAW1F16W}(rB4wwX7SUAQT<I>o>nX}*ghA0E;ir7ykaX63q$`Nrn
zo(p3Y9REab_7aF<NtuX?Sni`b@&l^c^?&%t!I>)XGJi@=5qh#5v1<(&GkYv*>}@}m
zk@Kq%&j1u&{s)tVy(O)@vy)#?h!P=A?Cex+Mi#IcNXSOztB*9{4`Mo|F<vHEn9xb0
zzF6&Z14bT5|L=M1|D&Z0Gyfjw9K&2Mo;xYn{JXvE>&Z#}2Re^>)~AXjvd4-EmlyEn
z!4wxMjh5QZuXV*gcXr;rzkKsObim~ly1?NxTVU}#0UF6Xo|nKs)AA*iX!e2-m;A>(
zr60`W_{XlJM0!PY->+Ur=>^jJCHq{h8T*hZgp;|CmqilWbv-_oi`sa40A0ihlQij*
zvnh3Mxl`0JM6u`K&6W`ie}#MSYj3L*%S!IK`~#+YC7Llf*>e@;7GL}{J7?>Cl;Ol4
z--d2tm(NoFfxti$SEdtSSL_6Po=!tp*l^0g=)IL}6Bd?lX@Gx&{kTnlc;r_bOxmwM
zAlZ<fKx9i;gJedXsU3L9j7@A<+t^}^7h}*nHWeXkB?i{N`XR(SO40raj5USZ8ilkd
z>Lr{~<-c(r(z`?DdO5oR3@8Jh+R&ekcXm*7U<}TW)>}I}7ng575R3HK81Rt|seH-_
z_5!-*Q^3=<5q4+ix8S#cyFOlxI?2Rj0Wx98ppCfPhR1^-M~q)Dw1GWEM`Sv%Qh3EB
zbwo(b$FP9jw~zkcgJM>nT;S;M1tJVwm76U(Ia8y!Q+m4()dx_W-wlfvK`%;Rp#U*u
zXGdlWtTODAUjmq7Vi9&%_0G<2QLAo?1Xkhi08IHAmow_4V4Ua>m(NzAI!;)DS*Q%V
z?zUtDtaE_sW-WcpCQ4A8#X`J3CFMhv2eWG!71`XU+%Sqb?2}JZ8dN)M3^fv9$Zn(G
zgl-9YQx~|IkoR{;3P2dy0qv9j4d-ACt_HJ4-i2F^??EWtW`<;@-r2dNfgPmWv;;32
z=4HgpE`ME_B-(6j7<-d>rhRcYbne&mD})O65@v+>;4=0m6DV=<5I979W1vsax&O(G
znemwTUT}+J(3Nl;Hq6Vz10HIlJr}gXaq0o0^BwiWXb%*1Zj;oGF+lKM>VfGBXI!7m
z^&LT!$B+TW5EqOtx(3(^ftJ&yji6cZxCo(lycq-w$M*5^n%dMpf*Cvv9`0_V6^})I
z_E`oV(F-q-_Ozmx7Y;pVT#E~)MHXhxn?Y?C1xYwxiU=|m4@xXP!z-xA_!7+Xw+uH1
zjkB^LL=>r5Cl5!we@gvV#E(jaEb3%!LnqL$ktZTRX3os;cxh`y9dG=AeZp3fz>G2L
z#y)xL%{<mQgAvSsgLInIgA=HPl;-gU*oEgpO7bCY@a`P*=^fg!tZ&&noY1A&+$&R#
zSB3u$D7$!qM=12GiH$R|F-BFq3>;{7M|n@<6sy0(VoY6%L10<P+nzM0d<XN-p55bi
z>v3q05ocuWJa+6EV(h6d?#~*Fd!q<s5&*I^0+zwnbgcg|#0uEMSyJIgOe$ofTABE@
ztOMu1sD0|dv@zlNiqI!p=chm8ta=<H*C>F%5!KH)4&eY+5n&*>CGM<;kvu7pjvI<Y
z!NqDm)hGf^VL?<l$!dTwM>G-8uW3f;bJifYjLr2;!%}$r@(av~cR9RW7B%=38J9MJ
z<3+arC7X1V0DvpO9Da5K)X8jyTP^TH1WR_U49;t&HZvrdB9D25cFRWgn4U*{@-DnD
z^v8~2Q<A@DmJqF=wRnusm0gj+XwM$rl?Qxb7VBj_%-<A!ll1Cy)HMoyY;KN#n{4He
zzC6h`r<%*~Qi`TQ#oBtTBB-8~!EVl|c$L39^TWAIM9zbJs9Cd_LP>o)!G+x3J@w%M
z-QF!)#B~gBi<2RY9>Bdw0>$_*BNBT|#TqYL;2=?0K;iRV{PqOQq}?hkaIz@^&ZijI
z49mk`?d+iBot@fJw4yXyQSZHi|9l@%p38U*ZW$zWZ!p{+o{X&HqrIQP`@jD`dvCkl
zHm)R!{=aM8ci_#Q*>>ELZTZ{Tlb&(pq}yvdj*so`-Dlz~FG`|pPGnJ=l;U>xWS-?b
z%XzX}RrnxC0^o-vTeiu)SK1<h0#F516$(|T!{CRbAKKK!5AN^>XypeO%)f4aFdE`!
zH5azkxxn)B5PD(@4qtt^#DcC*t2ntGW|QN`m6fB9r=QL)4o)s`wY~HDxVdK_Q3p)S
zFEY2tHX4jcU<ql%7yF3##cAl@y5T*Mc^T=|!ETOxR49?}V)Z`FP-yP8gC{AN(u5y!
z4!qUX2J%dpKLh-4X1*UJEFQ}2w;UR)v&Ckuw^~P?be1ApQ7GK^2ZMk3;~RT}ys*UI
zQO{^pWRK}ILOibki{2n{&;mrV0yP_p@sX$WZCJ2Kp<`;mT*U_NvGB`hB}~ehp;wvc
z4~kvWr<r+Wq*xH>A54=2%G?BOTj+vvb4yGnP7)^U0CKe+Cb-8cvY(dFQke1LkaIGA
z+5-Ftw5D-@JOlUx(-JPnpZ~wlyx;{ds918px~sPlPgOP!NR%@euQP=rZf0%@?%$;1
ztnTZ}VZ3R?-i^rch?^GR!OH0xs%8egbY<n3XUk$L&Ze+GAv_uqyC3eB@vb*GzVYRl
z@o8a+=_TIsJ*xgK+dT6x2_|`g=HK)OOtb6!a(2w$CwO@J6>@L(?l`!1j&bMWEQ3@;
zd+QtL=;Xtv*Zg}M_j5f`;n)j)8o=uCUXL)NHamw`M1@2mbpTZ8k8a4OMi(vm9q2Qy
zHlo21=#`=82^%D!^)}*q#E_j2z+Pj_)Yne%&0{3k787n|<rJE_0TeK69;3SDs5?#?
z#&9k>%S@7?vwU#&@wFrK?-^E~?zLv6X3C{rq*rlf^-hx~4i>hHqCSg^5{V>b6>*3-
zWs*H!dkMKnTQCvK^$8m0csYVyX)=LmPc28;;Gl(M@=v9cqr9Ya&}(lfa-KeVM#{wC
z(g`UOAKN)82pyTQ@hF>2&j?8mNM!#@kVsqd+ce1`IShV3ohdh<=!{4kt6$lfYtanF
z1Z^`YQnP=4(JXqMxP8S=>5N^^^r;}&XfndBXmPmuvBD}K_o-7i91l&IU|!+=981Y$
zqO9@cR!Z0NJkF;6R5+tLVpxroiuLan8jCW9Jfv5dw7_3<wS_yAwkm!!)XSYIY8}1+
z&ne}q(qGK*x~?l(d8rBjf6rT~uX;&$uA~wttCUWZDLQbP$RTYUNV;@pJemxk<p7lB
zM4~F6reapg1vgu{TSDG0w48lqOzvz4rA?<?HA}5I5A*XA?$dLMTwz{%>8N$}!aGN3
z=LoR!LOLN+^g`Jtj1$!j!Z)waR$*IO$V%a9WKT2V5``vIV(}GEbv+FWO|BgUW@V;f
zNoj3nC|%J7Qwr;Oq@XU6db&<I9ac;^os()hy8*Z7Sa$GSKQ}p&k}*nuXOgB$rBu@S
z_5}NI3Z{%!#v|rTkyO#uQ$&{?mzc6;QbB9ddKpqcmrDIyz3b&tJZrmeOzm7crE}F`
zluX^M8HG7zbJ<kQmB&y%C9`fE)>O<@QZQE?Pt{b*nn4vvv7DD<I5eeJo_=`K53Bre
zW;P5|@hYW8){G~HWlo8ln-JKT3V8-2oWaN{jA&*fsh-MMGo(T(jHgIlTy>Ci$W=T=
zv1VifLeb%f^0OTSskr4*4;#ip>WeYuaMe`9RmWC5rLbl=+El_NQV3V=bn#Tdnoes|
z1eZt+T(#4sQvhrFZcF`JKIQK;BbjChW%@p|P8UzvtLd~hRd0zDy~%@(1SDHVqwLs*
zi9J}M3`Pr(xhS7zVqEt9U5T+-0X^RM#4IsqAj-dMdS01_s*J*xVW`MR=9gKh{AjEh
zgz^V7$IL+$#*&vIsK9vUn;EG5n2Kcp${$$%4XTejx@kwX2&2*O04oej3uvLnH}$v{
zVLU}M@Z=Ay$St0aF+z1)SYcR7^~D%VdOKKgOervrKQ>c_oc!U;Co@j@5tuUI<d0xJ
znQzLEASc63{y^rM*{0ffst;rlMqtWNlRtv_WTvrgXvK+cP6nFnpo?DtX}kKd=(hHu
zZhuU9c<0l8MrbIp1AgwPu<x8-&gdUIqswDs;L$U*JURjvA>+zpBO!nP|MD>LQZZ1#
zyzl~1@lsJx#CGvgaA7ofyd(rzts^f55s#Vi<FUv7m>E1Cd+ZC4kz)~1@KVSAm>DzD
zV^@EstWA-NS8?J%3;O1#uC%D=oc~W@XR}zF96((Vj-AfElRyz&9$4BWnA30Jg^$KS
zTYq!RLUZl&A)8v<!=Bu5crciy!&&3a1NBk3(wFY1YG!$mzDj@jl3h*MLmsB5s#kp3
z-lmNg57OhT-+Re!>&*=h-1o|Tez3mA+fPS$u9xhzVK4vCy|3Qu2kWiQ^SorYO<Uy$
z>A!R;FWKqDp7z0dns6Pj(BsS|^g()#j^QOcD>jM`(m(V8FWEn_nR}4_Dem4SyP4W|
zJy>rmbo0Ubhu+&I`zQ7<rTVA-Ol>smsrSq&_w1?mk{Ge4)+>}!FN0F2T4J;;ij&=&
zXX?C4Df0?u6)TfXEI&0~Zc4noRCw7dkuqRrMbVs8cX`BpQ7P`qrnZ~M<jYB6mv@=g
zmsI<<6m_~OCR~u%#S?ic>7HyVx?<~1AfrOcxtEY?t{f7pq?CKnspQftTm6|*Ao5ei
z<?38@YPi{_hAXZ3)+yi~AO&1$s?@38>Qrxas<#)J>a8lTs8hPtDc$OnZlz}1gYu3=
zO6gXW$JD9Y>eOv@>b7b?XSD|F6m2(8Hbq-in%Ak=<diItimgBjHoZZ-NJ_9mslW=P
zSW8>a#Zw}sTGl8^0E#C0(p8@~UUE~T<)bAp7232|Nxv%XCYxHybxN~3rP&KgX*OLd
zGn;>eCLPO!-+-UW=b^wc<|>#X4?vftArM1QGXYddsbWfRA>g0GHXp5v8_C=Om6Hw_
z)1^FmauSZ%Q<ml^ot;EYw4qPlGBTx1NU>ytqQeaPV~%!*ryy}KQ&LNv=&x>J<02<;
zI{CuCM3ia?+mV?y=*{XatpMcpiZPpgi`F*QTl;LTti>`xG_v|%Q84^Va<RSQ*iz<O
zUZ#|dRHl@SXiuH>NpPBPVqz3J0F-mRJLkk88~Q|aB@%?lDpN3sMBj7@YSpzX0ay};
z$TFtYAPdNeZ%QO0OIlfPc2>!HQWkth1LG}B>7Lj76011ppV~sO=~9#&d^|7!E|85x
zmQ@!2M^jc3OGip%DB*j?1T<nXW%82@f@|9DJ#Kyy(jCd9o8pn|)H~9nu6@{M{il<4
z8V>3|2k65+_PeU`!jjIgJ^dZuvwmbwR?Y$XR;_{xlyalsC+<)$x3=>cH~K{kIzp{o
z<6~@gy?)cZbziS0juJyLfg{;CASXFjR##RGb1?QDIAgYK#P~ZG>V<4BW)aQBG+HxU
zl&2BsPGomtZ~l%Z|M>73{zl$`TW9ZgP#92;<7YXaV^<cS&lS*1a4*#kat%{-(jmMM
zI@!NXG56M>dS?v;74WGwkwJ_6O$hM6Zma`b_*XK<Q|fVCBGvTjy?Z-&jX_W_;c)OI
z^Psm(1_NQU^WPEe8ZznTWYH0iVFT-=FLu5N#=_OZ9H%GiW|PmPMr^5@xaYYI(<~SY
z=?BXP;~kkn?9fBI+po|L%#XMK<6O$NE??0KX9Z4KLPAy|IYSfW-hTtcwg+w$!3Kf~
za|YHFeLe~J(H9`SiCuYhIdq)=CPfiVzr*oW=l%*7i}My{?qG5|yz=|r?>;by<)wBo
z7*L}>2hkXjy3|-&dX4_lnH#_qNLlA3_GI?u_~@+#c_EwPF;9eyN8NY=oCuba;BMc7
z!8c?AhbQOG#RQN$fL|60XQCrhlOv`v+y3Ew-Ok&$NI$iO%U34s7@D5J5Z%;~n;%6J
zt?wxZTz0550ohnDj+*UHCm)V}`sM84;^@=K(fRo=?;m8$H_$a99|yGaMl8&5lx#as
zqx=~P%zaRy>!YY(K?AcJ%sGQc<2XAwI)8sS_mO0#Bhkve4JOQHHW@;XyI*0jxKwU@
zE2k|!Qeb`W7~D3s^y6EnwZ1;*v6A{FlqrlSp}F(Hy#<|f%2CBJ_Ps6+Xjzoyg^mti
zXIh+|6QlGr<Q@=@8AoE*n30IivSFaFZ35agTx7ZM0(ZXh7A1Q8s1pUFnG82DB&!s<
z(NjESrjOVg<=pfs9`jTxeszVcV!6UXmRb0zGyl0${`L;1<n<lv8i#f9e3^cZ*~9K+
zF=P0hEMX196OZ9^${Lm@OBD&v6OVB%IMsr?%qu0?{o-MJxlwvC_zKZ_vU0J&DOtQk
z0F_e59-}7<=7#&pk~vX*;?YiY`d|b<>xq#Q^%ujgqyIEWDHjDO>pj4v&WR2bk9h{_
zKNt`AEzyJGu}$5SLVbab^(51n1&4f4h9DW4t?<{6%wzuExrJt#gA4m|5O&F%Ncchb
z9B+s=Z=7ebL9+DBp$QWuUpCn+;;sGr*zH7b56(W4{qi)p^TP8RZ!l=YfBu8bx9l6}
zbfbNIB)-Rg!UwbPti~f!h-NB~L;8vHfez=L<@WmzuZ0DlaCm+n!9GsDN}4(&Mud(R
zBi?}Q@>blxz&aT=fznOcToXNwX?-&HF#6i-h89E_rg8}Zuec-`!sf(Nc+Yq=bb=7W
zS-6WFd0lWH=LikKBRAw;C6sQO*-jhGVUBF`D=VrKgY?4CI(4CQ3Atdzp6kI7i0<Pt
zf`!QyaK;jkogWo(LXw4xI3vlz`OaG6F)=UklyKe>k9iT|Q`l`uJT`ETh2LDKFY#1C
zZywZH<Ja`b-1qntG|}s5Ubdtk>(iuJoF)-!CFytv9+YOV*`Hucmh`)qe*f7cXYMt|
z9hKEX*(l{IP1>;PN5?c{wZ_zb(%b8;?bg=D_Qo23{Xtsi3SnC9$fKa!9j1IRV_$%q
zfRsfjGr&#DJ%~ham<WduXC+=wxU5T9TIYGtmCjFJuQ~_J<yl!>skZI3;1O1OY8(nL
z?;oIv9}w&h66_CR6})Dle0`{gYA~n``l;1WW+96b41-aKp68~y7^!!3ByLb(`!=8E
z8$~rWDXhu4p1__+9q`@VU2?p4BMQ5KrMxzQ!MVL?O?+?0?o&+y)I>VR>fh?9*Jq*h
z*_8kU8~|~Kbig0RC-u?7DL8VuWCE&~mPUcad@3>=Cuh5DyGRWbS6JgGr_=Z-?xCwr
zTj`<a<nJWP4S||VE&QvKVC=nd04h6ILPG-ICz2=}+_RnHu|J&r&OAw?EADxH;(qh5
zDdr{+>a#|w#1@7hQy$zHV$~VAJ&#<ulkw}!pF0-=03pq^V9MeahXr79pXrFBG-NTD
zfkS3qI<Ib@sVr(7?~>!NUAIfNP-FoNM-hhQ+`9K5LvWvg8@b*jj+b@XYGCfl3bwJ#
znHRyvrFAwLc&{l24qci#8IHz`A4u0Q>=54r5=v<MNbWq}TB{qo4&dX~ANseG+tM4v
z!rO7?rO9^V>^qOAf6c7{8SDyVc!XYtE)=(VbkTI$S_O<S`GA8*z}yrh<wm9HfLq)2
z+V^O>cZG#tTtsv0c5h(DX7AcbKXwfopHl1o-Kv8-heFb^p$sIW@}QLvk2Y|0+`d5A
z7zaAYDM=26VBOuhVNaCjAZQX)VJ*cNvD&Z0wj6^PlNf-8u^`Q{K4VR4Z&x$yNnCIt
zc#xt+tP<-<Mv)+I;Bi%|s|R}eyB%C~6fqEB*z9H;5WtuHkGwBDn!M?VyD;83Klwav
z3>kykjO*Nb?hqJKe=>mbEXcG0ngXyxSU(D5m0O0UQlG`rHd)`}z>+tPxX=dJ_%*f-
z3o+GHPpu%JpjQKR_}m+F0!l=_XV$;CFk6UfX{JE1;xHMNqW|mgWbNn_%f6R^EJvq!
zlTe5%6p#2}6z$PDAFfWejfuZ74oKIy2=f?k09Oe@KlVg~9`Y(@IKhx!B;3jh=;3jP
zPQzdv04HF*XVy_KBDO!`pNPq|51ej%?SbR>MSM2~>Jcn43C^+Mzv3Fh$dFayZ0h8?
z2;DwFaX#Q$$emr=>Dd)`T|1`|(5p-;tT?mT<dm9Dtn~ZeM<Rq1D)Nx+Bc$`Ni=j3=
zES^fk)6|xd#3Z#uP&8eR6peUpr5K_J7l&yk4c?j_vRIxpA!RSsZc<UDb1N%?%W+=M
z3&dkn!pCqQ1S<wFr&15LQHMeY5cDZo&34bm%Cdb-G?!p6wB`OUG)nWm9mj=X*2Bjg
z*uqKv-&LEYfM$o1KH!!Ky%{i~<DtcFd)4{X9r!(*iCkYm!Ij&HRnVzh9~|8`(Sk4#
zOYe<0sP%k8MK$RVj^dH7P4gKqlv=rPxm8@fvwlE4um)itF%^}0#*;;3V;z;n$r!YW
z2`u-4APpZn-df|iw~>^&)Mu%_GoYzX4TG`lSi=dq1}DRs6C)PLpr#0agaf?F;v;sF
ztC8xx3a9tu8z>#{t5&#%reHvAiL}Ny&WP1%@@OT#wLptce6j`e{2N&))I-+gXwnN_
zryDCYA&T#K<EOx6#i!IRIDTTw@R^1vOu@F#&mse7kMs<Bg&1`1u7S%pKS@RH3Ka9J
zaTrW6Q068G#;c=yN9<2R_imNhMqz6ZaubHxOv){!$f_l$j@FpIwPtJZuYaY!@yTKB
zS`&}Ta=8(E@_7<_N}JW=$7o=WAA{3R{N%u})-QNoaFjBSP#p8T&JC<vnR(er6(*J5
z!f;-(M7Q=3Ge)Ce5cY^qaZVb9*Ptn}`x?}eqX2~HJ=p<<${ybNF%xjkZllBvZxOpO
z8C2*t$prH(<%O7inRf|t8qFE>P7_B6e9%SdlpTJFKx0{DMnRao_ELf=HJ2I=I@m5p
zuuT{*8v`{dS`b=Tdi`1-sF@qI2)*_&(vwE==n>0_!KDM16Cc|-A*zlH=sn5?TN)wh
z0g33)1c|gIzfBW7%wh1138vUl(HU{jpkK>!b_!l+C?;r|L6I6A{zbFsb^P!ZyUy0w
z^-P}%f{i94+=my3s~;<@0`kN=b;B_R3hGPYg;-ch2Ai|SljkM6p678k^{2ua)e*yL
zq)`38TWBoG7~<3=;rRE|EEBbbXPmYwIV|hz<<1nf4qt%hw5w41i#GtQ>q=H$ssg~@
z^H%DsUeYsgCV|wVb?$tgH;Q!W%wRO(;pG67WkaIsJZ|^M3f&UIcA<r=`Q{HhDD7Pv
zRj)8GU()gXB>VJiB3F`^UOH-Bz2wf3*g4Xxyo62&6um^YN#aCxgXGQYvsKcTmazGk
z56y^66q-<p#aH|ulxbLKa_uNED>DtteJ5sy(iL4W-ET7U`$>x2OH$uQQr|~X#gly&
z_mSk>kdZZBRJakN%1s#c4H%XiFl=|?AuSB?)mdWBB%ZpCqkiN#YTI-WygMge+H9oE
zkB_#+MKAsonExDjoOtLj#pg)Q<v7{7QTV2qoXc<uT~krz5}bS+eBmJ!yzHj*P)c8N
zGtHQaUS?Bz6nU4}RPA(;%W6t=w!kGdRePG5E)_1LDKU~lm(WxlOS#Kt3iW#WOJ;1G
zt4@%d8%1C7riDs3EEEhvFB5#8dy_)`4GMWTCuEO3GGJy!z&amt@f#7!-h?oZ$@j?l
zkn0-^3g2K*Y|Xx)n+noX(IVjd+`z6}1!A#p9w^|Rs9*m@Tn`IHz8APrz~uH-;syb|
zhgV_OJ6-j8<0bbdfHG)#ummvK8CEQ!zqDdrNA6D@xt|xYKO367gvk6t5&5%4XB~MT
z){*!5k@xcz@bikSFQ9nEkD+t;JWvFE9XVe|&X?Q<){*o4(QBai6k69$Jwm>YjISf(
z>&W;zGQN(CuOs7U85uvNSS=p`Uq`;nPQC2N_X0c4__0hzd<yMCmEsQ&+5Q3}+ReO#
zJ%!E1@neZPH%6S#;AZKv5$UDu+tw|@w6?&-jxaA9S#I-ODVaaDP8T`jV}cmD`LQ`u
z#JzMMCo%YDofy1M46ZcPEu9#AGs}XKT1v`?;OQj>->egZ%QCrlY{-c}U1IR;tdjMz
z3Pw(--P!x|3+LceGaQ0fAns0<t>f=1#NQckxgd%PNA5!^DEz~eiisYpi<QTkkJM5p
z5xtkHcGW&M?3(mfFzGS!1Ts3u<Bk3I$1;xPDk>7mA|BK3bOz%q7~vuT7aJ$Vw_KHq
za1qa}#@ZDz81QZE1CMY<p&!tO&=<}tQw~!AL^o|Q*!J1c#Zmj<m_-<7BOrL&N4=|S
zihW4Jm@`g@eMckom_gd}zQiFIM7C+MqQ=6Bra)$TSL1X%oB<_b_B;eKj?yS7pIkYK
zgCgT&ZI}mGf)OGcpE{wkhDBQhf+^ltkB>rOuLVP0#Zv|V!azO0L8|G~5&|n8GqQ?@
z#L6l~QU>Q?tys)x$&k@HgDx*sBz{XgwnL>V;Xu{{hWW&G#o#N%cgf1dLTzO65+OHA
zojQYVZqnB}UQCCSa&cp_-UCePd1cTo!4>_&KBtAXsl^Wdk-hc{pV-=oSmw00P!NnP
zoF6149#d3|cuE8fiN}8aS^D(T2JW%&n;UE-o+{|ggF0*cnm(EPUNA^WJX7zo9xQn2
zc^Uf%m35lYIR`UIgcJ#C5>I(_KZ?*PF5}}T2PQr-s#>d#BQ~Fj7_EcTBV;K&{AzTM
zexT^n$2Rwo+b@<*B&%THQu>_oJxMvf$5W;ojgm9Q9S_`S%^i)_?z{oK@Lo5ZYo-7B
z-4?nHcflWmnoX|jsX4Ba8yVUS_iAVE-`EUk-_uU>jm`DV{jJvC?%L16-4BPs4@W;R
zAK)L{;SbQt4=|X2-Td(S!E*|2z{F^4UHF@@yqZ6G<0d*j$}72=h!UYIR+$<iUPcY~
zlTNXDErTj4+BUOrMP*&(uIb4$Jx*0IHPk3PxoXk6HAD-|?Fc<&^U0E<pUgnfI4bBJ
zCZ4Gjj$#2H*~mEq8`izn;3V&Uj(q>LDNgpEW2%nLm!7J_;56ctzu4R43Xy-ow=7xW
zqHkksb*heZy*gEgrp${@)sbF2l~Z*TaV9dkHcgqKBQu7w89Fim%5oo3bslcE&mlvH
zUbdQDaP6S#3>_5(`t;l(SAdsZI%?fILkIu-Y%_GEreq0+<Y`!Fa_uNED>IFGXXuzl
znmUCXglos(=^cX~DZvECp{8s(*Hl{!7xt=js)Zt+R*&gnWgD=VZ;zEsAaC>!<tg>0
zILa32Zv7<Is<|WQTg(dgzo6T3!Esb@H?BICN^Zr)hB0?{;;Lh==r&wz)bnx|o@%g1
z=^+-s20uB*BK<eG1KSu&ef52=`&&g9$x5z~1--}0c#Y+{K<2wX=D9p(&4?K=vm#)9
z^?h+y#<DJq^O$_oUVU%jDt@keLN2FXY?s3VULSg-7xD5a<nmU)mC$r-Tf%ivf6`po
zl}%TD-gwD%0W5=-`o8hnWiQuNZ#Fb|2`+hsT=DYJIalVJFT3K$00W=7yVBJzbaQv1
zGy7Q;BK+K3<(|2V+zeu1%DTXn63DZ0b+c{#OJ1>3U&%40$d8eke@ZyT30(Ja?h4zg
z?+UB$3R4>DmcA=&E6Z|{x>Rca|Mcz(+p6yhlVx(9d~=WRWl5_b%g!oUPs-ZQhaO-W
z?_KYGDRd%_{s70`wcEXC2}ukM6z~m@WosXS3O)i3-o&a?JOG*(!LCz_I?MvWPZ7n9
zugM#<V`E5sPxOG1J6TZVg18*2iDzW?6q!DN?TP^bMMx=9>c}^%pgmv2U5G~s+aQ)>
zO4F-YO<|jH7-`2tm4#1qJTO{WIhb5Ko2`ZeJZG!Ht(VbFFd6X7I~^q<B|m1vu2GT|
z*mf~*C`yiSIdpy@WPRlMF0ov|6!i!=h`im_n1+Sra`}B6x}1FYt{X(-Rp;|Zv@rC%
zvFi^Md%7;Q3~W3mQ92{0d+RoD{cGH0nu7QiMZJACSL5ojyjVBTrABP2n{fBZ+?pRB
zLLX8}kzb)5m>+cTF50?$MH8GA;Qr9uS0b_g6Xht;5FJY&9kRlld&}LmnyR6RT`^vV
zrhBb7Q|Gyxh{sH(!tNWDZ^bjFw!e_RC`CL`#AC9;%wUKGJyay%vO}fmQO09MJhL40
z4RlS2?t%BsV_2BsD31v!jq+zGF!w=)u8)kIIY7*AFy{;&jpOX#==}ZR+((j`jzlZ>
zR`?%HhS1~gR~RfVl^eg@b%w@~0%Ll|;I^ryAKyBy_4PTAwVcn51Xg5J8TXr%b?E5u
zb*9DXIkCk#R6J%JiH&VWUOCH#fojqfNNBm<q*kO&?@}tBGUyZAmPNm`&x*Q-@<$bq
zAuPNM-s_wD3Rz{W=P&bdON+r*a8Hw!i+Kvk;w3zWlsfgzeYuy-)$VROq?B`ell2~8
zQr9>4J-i#8?6sfk(IFl?5sP?u$ihY3$z<VtcRTTz{L92s!u?J>X6}YhVYf5!*uXs&
zeskUS#8U;mc~EDKU(+XZ-wV3?iD&9f*@L+OK5wHbp|-xsuabY3$!*Xnf@+KZpm^qs
zZ`F}6bxL#-P%2U=GeA`jk7~T3$eo+?(vtb>B`mGip0nIOKLyMjurnoPd1W%1+law0
zE76nVkd}i#y#4{2_yNKGAi@41mceT}wQ~AU551f~Z_v-JhB6HSQ>r_dVKPROjzm5-
z605sR+x2O}!MpC)ChSc?X}O+&CaDhi?(Qx*-n&tg`#P*mU~q0PS`*)!v9Cmv05y@$
zO-bj~QLq1+)R^p200ItxI72#93*!^1s1TD#Q94P#c}?Xbc2cNu5mb|^lLy-%&YjJS
zQx2VUI4sjU%*6K}Uh^dP4lINS9c~CNVCc>bDf#rR{`{HFB7dY5)?J<rn6@#9f_@m>
zlDRtcu4z+r2igN3a)QiJ)=5NJs*!2uZv;TA9C~4{6K|f*qd4-m9G)c`<^^|GbvXtL
zWE9SlB@Y_Ikwz>La!{Xl8ApKS^*i#J@g1@nBA!f*DwKL6k_Hy7E%gW(kREU#!4Mr?
zZXIv<%@2bi&hmysVj4RgK-185oX3&v#>49Rrh@woM@(WIFw8<RSFs~QWiD5ugbF*x
z(MPrq#&u54BoZ%4DrHxdq#x|beNbSAqKmN1am|F7u@-okx^CoR5}pq_x{F!AN^S>9
zEbzY~dM%+r!_*YWTIZsD%Gcn0^K$b>rb*3hwIh_;G2)Z6RVlf%p$cVoH&j90LFVjX
zc#Xn)B7E}pMfem<Ebc4P0z~)VKD*=!WEgi$ImWwQ|B5%^g)`494&7W!w~$OEo@xKj
z_3zG~t?#)=wr>;hDZN$1$GBa@$6)ctXR2)`FaXBHxF}~DK;k%jUdl)@|9Mp>K5UbX
z6gH<)eI%tpt7VXvRxA$G@d00gai6%~{A-l9P<>_PBRSVPKV~#(C=3j&4XWN(0=Keq
zh@MYFrUkZDOs%XqW4GgQeP$etpzfxqyRyRLGk)ZK0npARFiZG?2GEt2H_lJ~H;>DQ
zJ4bEC1xD@;VSV-|11LYF@(p0yu!jZNulTmfb<tGn(<rE=!<Yux;HMEYaKqZZ#<u-&
zx~ZO8K|sMXa_aE8H|7MCh<rc93EztgGmTL#&6H?X9M-8)^nV?mtR0<V+4mG(Li9g%
z++HulZ3G!81x0)0e}e*p?d8*ItS_DW$o-8Pz<m@#KlWUXX%dRV$!!N(gFdaSfPjoU
zbQ%WZ0Jt6NJ!xrx5ZsWUu0@}SJ+=>korK)a2hi9jh6z6a6%3Y`1n1cBUs3CiJZfhv
zIk_%Ew+~R954aX`XV-RmcEw%S&Zz|SDw7H;&TKY0rKS@r{r>k6^Fc*q@%=GV35Q*P
zf%+~PYOpjsO>HSjOj0!jMbqVI-xtrV)b>8&rD2+RtdH6r(#d6pkg}I*H>s%7xs?^c
z<+wF~7l_Bk3$mt;aK!-j9o6A1g2vFD06i2|v)!|?vTPp{%_Z0isg3`I3Ldv_a9kK>
zJ$&3*bq*x|Pr6@WG@&y_Zv-?Opl<+%FcjHT1EWS=tdKFKp@^A`iA;zYRCc)J5Ryg%
zIW;q&klX~b@~ZH80CB1+#n=VVzx*DqC~+1eJucp$hK{j-DF<Z~!Z#j}&SxB#Je1h+
zBX?4W_W@bo6&|lb+W*lQRQY@EX-?L|jdkZ1*z_1EF#)bJ5Hn!N<{K=2m_oOaL^yRi
z-ti#Rqg1cZ)mikc;e;BcHXgFT1~o+peDe@{A!=iqolt#jMo+=Li)G5^ZCP~N6|r9#
zhrt8`SZ;z~Jhv@Ns*&ujCEW|$xjdPJEl`Mm6~u{G{k*uMvZB-b3cjwEqS!{}cDq4H
z7oQ2f6NJ~GzWl*Lsg#nV03_S}B`xdE$FaY~kFg!v{pzmXMr*_vJv5gVkziYB=*9|3
zPE*R!F8ea?5}!1hGw7Wrn(aB}$Jl!5`7sQEl1}++wN2rF`PXa9k|nO$Hnvvh$4J+!
z^J8eryy*NG>BUnyKgLYMd8bU6kr`Ckgc%tCW!aIaI*+?1o<qV6y|6XkLtzJ1C(NiQ
z;iqR8xe~qf(oyTy2{ZWTXPYo1H6=^j$}tTKO|BgUW@V-^?}QmM6|YXATQcg~G3whf
zl*v@zj`2{pV?0vYmE3z7p74DPwk!D%Q>9bEOcmYx=uy2kbO^Tk*ok5mB0Bd=al9>1
zwwM`R(~)mNE<A*S*Kw2{O6hAjrWsSw>o!V{BJY}ws+}%!okoey7Pv;EYENfzT}FwK
z6uKs(>R8HMhf%24(_e#O<6Lz*n%tP~igEvy;{6MTM3)JL&W-EOkLS;e<Ih^{Ghk*#
zz&agGY>mi^&o3L7Kaa^*r=zJJM_<4ZNRRX)jz5JQehN7Hn0!P^#KY^oLJGUF=&H{f
zFS#)sWzbTmqp9Q2Eu_)MpU;LSFCxyoP<;7p@ma@_*Ky<p;>fGTkC&dRM=vQ(JU2dE
zuN%xD9{h#Hffv`iW*+Zd$9c~)wqbQ{aoz=XH24@)^MV>Y6)d8~Q$clyW6;@o$y}Wu
zACumXPr+CRf66%R=MtZ--~QlJcngG2Wv6=EcBy=vb!nkp$5Yqw)O9>{9Zy|!I@R&i
zbv$)apgiR`>S@HKs$}K_kJj<hPd8q=z-D6J#{jc99+`FA^D~Nfe#irmLUGKcxzb|C
zE0>K^wmFiN%n4a%f1B|EQjFaE2#+bEC%TW5?0CCQc3dYrRvPM-PIkPVWkE?jAmv^1
z^pYKK*U64$ncN#2<iwvY*>QGO$$D}4)|m*vNyKky_eeb0#sIQF;Fc^~B!ElXg%Y7#
zy{8$bWx&{CWJ=9!CoQ$|Vsf1S*2U!fkFz8wxRfp<!*ZZda$aCj=f6oz_Rt70zUtgx
zxwo$K7LO$+x5F#H@BQvaV^|<<aZd4b5RK^`gvQd+>$oi?LPdczi}Z6nb3BiD%mg&X
z_t*$$ispIx<X~nk@e~X~N>(WpkR+ZmbXIr5mOv%(m}y=-a7k7vl4kH(P``Z8l~Xe6
zYJI**5$Bjy`5lIkP(TVzmo?ZnjDjJHA}y58H8+GZ5&3xIMpxYkV{cCXbME<TaeNOy
zGHCH(M)q_2^r43aO+Luj#1YLg>RAsvM&9&;4D(>p^T!W7K5FwpM%M;rdL4xK&If;h
zJEPd@=V8x^=f<u$QerX0%Xx&owA8&9Mv^ElEu<IJdfPs@xOxy29gN~I{U?W|gVWRb
zW9cFoIjwc);?Ow^&}0)iKf{uth{t&&#YsjjvY<tZQB=-E4~G%!7?mEg-gfR;=_@>Q
z?mifX_#yPs=|Uih_2%gG(GY`5+Hee;{x<hXCy9CN!De#~3yQ^}LkrF0_Xp?io9(mr
z2N&7cZSj;*|LUCBg^YJ*nkKtH!`Rpue1#ZUS-DuaqAXq_Y*DFG=fuuU<6Otw>X1?{
z_Ey$=fJyy4b7KFvvU2qC^wZhJ!O6uNx}wUDbVsJCbFVsLD;cp>I8y6bMri3L+tixX
ziweM!NXQGs5|5o*%^)yK!b*`P51R9|1GL0r))-3Qel~$y60%`|B;8!<0Iq7zmh%hX
zlJv{>y;L9TEW@XePiCS*5&z6Yg~EYevPPkRFY%ZhJ=Le6)917SV6wSq5(p+98y{m&
zVb@UgG3vSa7*3(^G1fCrg=qrF#51)rGF4z%9Z^<Cl+_Vsbwt_AjwnOvEC#W%f@}^2
zPs9Vg?)>OR+04O=nS>!Tsmm*>9a#xYUT=isOf$W$P91VGPZE7m{_}(9_2?iYN|ru6
zJhDQ=@3Ezye|t{xaN<eC#kHl#lj2T@y7>mUiD#DLybgTJDAn<hpHJYMoC(D@VfJl)
znax+JjaPvHIq~G}p9=1sDg?~Q7M@SwoOtXzrqa8msdhYt0_?;yHCJ5hz&qLNk^y+)
zseGqN>O~sO8T3vQ3Gy5hg>Jv}M4^TtBd2^iF;nPFep)eEvP60@V{3Jy&~&{zQK+WO
zi%t}pUOd$kg-#a=H)U$j%rMHP2F(B{%Ya1Hc|>MEht!~Y@oJ9Rwu7ougI1L3(=&)%
z8D4tnsCDbqp#1Z*O%0lwk|ko;r(vPVwWGkS%rxen8gx2=>J*A8uVcxJ#*#m9_QnE%
z%FjGT+;$@o;&J-ijyeL=G2he1eB0<I7W!i)p?nrpe4N<rFU6@m!<3ot%Ee+=ja0J6
zVCP#>&HaD4p6g<)r|Nm(SnBD!u8X0brtjrrrKcW)DMoslVU&o4p1S|~80cwwUoqBs
z>XB5B-qpr9PlJN$vCNN%1#Jv-RV<W>Ri4eD=M<wnJqC)!BF`HMrDKq*4!m5fan)fL
zj4`&UD|MdS+&IsQvA~sLfD496mI;r{jrGls@y(0v%^q51z|4w(b)MYfF}r1Bb>}hp
z7CTRF9a~$+*3LM#wzS6ZqGD)sV`ueTWCpRaFDyn@=K+(8+u6jz)-ka2^t+y43~WKS
zYwaw;r?9(qVOQ(ov8}~oT5Z1A1^uw6jbVK*v8!ee>{8y>l^uSwq?{%OwY1Q#V@>N=
z(>m6)jy27lPIatl9c%iGVoet##&jBSUB{AUl-qd7&nK3&z-C6j9WJtoDYStp5F={Z
zj}+XCREP<EMzNs!9Z2EbN2wh}p%~B7TxqdmIm^ay+D;ksb4|s?^S!mF@PzKpEzKV`
z*9n5J=?s6ZI>X<LGyGj01DYqJtAB8eJMxd`l<QB-C;qvWiWSL7s?_1w%+ma27h7WP
zU>9{B4YnoH7SRydK~deRYeWJN(FyE$S5rV2cCiPf(-f8AXZpbB)EvD~6<sz@<LSxS
zP=qoZn92<<+i#?i5<Y?PgY3IT|9h-Q=4HfQFcJD5ZFT%%cQ7G2aCF*m(1Et${Bm{-
zf4b2PbM$`?6C6);ur~tf;=B%E`M8U~O@-Ux$KGxTiU4h>sAb$NVBMvQqr>-0w1Mw=
z10NSu+*>*ol4He^)XN5LJ_k&SEgc4+ws|1~;a*>d9@?&=#L*f%U2;Nq$RZio$;SA`
zhphk*pH5L|wo<PGhaH1Mhu}X0I(=dtYQT<GSYJZY9fxCvH-E^t6cO-bzwbjO_-D|I
zh+zOMih6)9vT@_-CX4SteTVdY5A6>=+kV0bu!Cd(#ytUg7y&=@yY4_8SN2dQtFYw9
z)u-c3)2jg~+iK!sGsc0VoB6>1!|NTgS^VnHOA(}Y`RdK(tCL{tA(*w+>iXrY#^oy?
zIA{c)K0`sAa`0!X1@Ae(f}be}$Nuo^5mb^8qVfH}qfa=+=oQ9n37~$DzU}ooo9_Dd
zdULb8-)(Mr`>m$i+1hWq-L2l%?#^C+V||nAcD=#iSJYbtND1+RCN8~}n2{ez^P_Jx
zIoWDt{hM@@nyplyvF_!o?~S;pTO0k2z20WG>22+7G`IG;Tg`p9yWi~Yw07L>&Tg;O
z*`0Y$$rOAv>;lI?q-VOlmD}yz)}FV$<#n1{yL&s$tsZc>j@NHBH+MJoc6WQ7b$4%j
zHr?jy+>GOm+|KUp^mcl!omO*ey}JjU-Rm~@THRiAch7ZqcQ$rf>)y^hI-7^)O?}V5
ze22HV?&QnJX*%nCOk&w=*p`i0cs~KxAIY_IjlV8f{mWNg&mW`oG%n0^1E^@QnS^{y
zGJhq-I5Q;)#@)mj*JP+zSwX9T-$gTU)qLImw$=%Myu1uAFNdcCGJ>fa8$VK7==)*B
zj%mMo-U#ik+$4z(1+dle$SQ;<?PGN;s|<RIEXa8g`3h0Spcw;Awo^1QV(c$}Nr^K)
zo2j{Gv&q}#t?QcFEzuPDK;QsD0HDxNo0P^AW!StMPLi&4Trj3ENrZLd4MtjkDCLia
zJv8*gZhTb$OIR1h{=uOM36lXyv$AroI_Vr8q8&Y1Tf!v;g~{^^`is222@F?#ptGVZ
z86q5tRzypx*x34G*vS$c?p4B;V!Snxt^aSb5;I2>oHoq%h<+SQi-9UQGnreTI~Kyf
z8}|XkJ%@GF7nM}agbr>1!%RIQuP5d$JCMD@kU3{#%eeu}ML2~;kGSBDy<^l)tt#z~
zdBBtKDsTq=S2|LGI^-4%$_%;`1EgU9e@BzS7>(r6KNVyH0S%ol8Gq#}|LOe&n+Asm
z7Y9(OGZ~N3g&;APu*cr-u&Wz;yqbw8@S${Ir-y86*h>%t{a2V_lyoif92SRPhzpvq
zNMhu)exIG3tCN&fkuclpSVFH4W53}e5MUFOW(HHVOJ4I685Ovynz0rXR;B#8vVwdW
zhW!R6HjF6(b(J|_XD3iZ=36wdlEG3lg%T4+aF+&GEYUja_P+TMTf8tt#`3W1$At8Q
zk-!Sg<NhQh-IM9Qs1PTaAgJyj9QC|uKgpZ+ZIbEl{~Vl(^_EcVV)gSfp~~&<?rnBA
zI$KS5#{*5H)!J?DZ+P9NyYKF9xBBa?tsSOm6lz6wU1dE-JtoSf7*Fvf`pO4~V%Lw(
zxHloZAkXGY=4MZo1+R-3(f>Q%6h+xK5$d@&#z5+bAxrF_k<GE#7WO{&?G0jEi=VZ%
z@Gc>pqMP9E(CfRftl=$r(&KA9i=ln;@0>n8epK@jEAQ=Wt>g1u4C*45IBMT$tZ}Er
zCyM4?lV*UFvg@|CJA2!E&7J)Y(sF+f)bf6>x#RY?`>nm*-d=073N5*+ATUotCPmVu
z1e%hfe9<Pzi4haaOMfQk)%T^>q7IK<P4p4>Ud~%5O!PZFYce$q6K64~{UyOQMj!y#
zCT%9bRielI0yt0$4=01s{X7{_*WK9I>FljHy;ckMJ>AYm(`~sPZh1EPJL|5y)ooRn
zyzgP|jyYx$GgiJ*=4oN7qdJJ2a)R{v^78T(dX3|M8xH>KkK(^4;UNBT<3=~}FAuFf
z_{SI4lVWp8UGn?=PT%e9cAEXoJ>1`JcAERU+rYj%t-iOuhy0+*l4n>;tOh=@{OG4a
z&~XRxLN3^A?1S9<rD?%8ZH1=ydc!)s^Vs)yHfu##;jez=Qw){wi3urZ=!r#|p&`%>
zeX%X@BhWqG|8wFFE&{$vG+>O3)DG=S!?-Y0+m@=v9t2AKfDtBZ@#$}DY;CM>Z!|kQ
z`!3A0&TiA~?(a5R{msqZwzs|4UGK}f${ze6ygi^3H~BH%%_mgcbcdKzsH{ct|2W0o
z4cwj=Pd-<`Pt3rPJH8<>YpM{5*3#lbazCO3e%DdxyK)K@+tNwRqnXu5i{qMZTfR09
z{p)M2ck2#;nrq=?`0wt>7pLcMH`ZG_&DMHzow2q~&|@O;PbQ`u;u1t$`0pF~^=Hh{
zz7r=&6lIuC7seS#g<09})EFL-eDuaQ0i*Egr}GPXuh_-u!(W^O?sI|Lgi(N#%O|I+
z+n|S=0VzU2J0HUSm|G8U``>kACwgZ6#$6uS6@;EGHczxeA)`gC8{Xl@h}~l)ch&q9
zeHCUtGv$<B%qiYhWg(}8N{Q7g%uO4~g}Z56x4^Cw%Qn`W2C!S|O>S@RugKH{x(-^+
z>F?xa8gKA}hn%`WTlA~w4LYRI{X+go{e^N2ev6+Vyp&%ky_BCMzU1%M&gU<GV-svL
zMC$obfAYs4_iu5js@>!>b_^@(ifz2;%B`#RaZ&+f9Yw`&466{>I_Q7O<X?Ktrqzg*
zSyJcvl7J-c4-t#RLHEw=wI)nvUqyUD;X=85^|}$)It_!qPZ-u!9kH+W`gmM$Zw5f0
zEf6Sj*igNT-)wbp!S(3YC<6dl;HqbY@_C8-*d2S{yus2J11xq|)zttCS)d)lisIL~
z=%DoY=c}<1f^vI|4ubHUvOqYx<?e`v8NokWAiV#5<a0+nJq%A4ut51`WT-u{%}KO&
zm}Ugq4nf!PHlEDXV8Yh_L#R`z<w`HPOGUFAb8)QLBK?u`#!1K((hv(Pf!Nj=GYP#T
zi_m3qOE?=XuYu-xzn9wk2Y1K*E#4RMriI;sLVaNZpiO;sablJQQV=v$1sFC6cHvS`
zJ|%<;GdeaM<=`WUfRWonYb_Pt9{tXW0X^Q4%|6CLEtm{~iCY<1Ukpo+eM~L5WPKso
z^!$@P>g$&gjG~jpMI(A7lo*u4iuk1@23AfVEwwL>4^6lj^lG783*{#yln<|U*X9xO
zuHA(b=5*IVEzYMF=Vbk>1^SZ}=+wArx#PFgl6wSk&bwG#n*S0GijPR)M70)BYXP+u
zAXm`~&;o!T)JnkgN&p`8)jGhF)d5&@Cdo%1Q%mj<v;fh`;%WfK7L*v2!i+vIQC)1_
zC{YN6Zg2{mT0qwVS_k1V1@z+xT3ju)q@7;Uk{3-aYM-pA<?v1Gk9|!oyGIbVvYW-F
zEyeGZ8JEJ7>Wz0T*K4^hpj4CVPix~%9HCYSrdJ4<Bkkg91V%@-djTfhXAvD)5CN@}
z`!>ZQ7VUUz9ebY8Tb@|_WAj(vZHiFPm6bSXY2jlb*}sxVjL61_$h{I_in@r%M96H!
z8js^6wM}l6Xwn)PsWv_DFv;XNiv>+KbP<#IQr-r|11m*D<jTtD3!pWO=IAiKpNCQk
zq*4WV!{#J{f5)M_)}IV}E+rutL~Fn)n&Y6^_lLdam|(rmMroqLe@1sKVC%TR_-NC^
z`+)JAY;XrMdQBF?Wx?VNBYutF@Lq|i6hP|W%<{pR=+%pO%86c-i7Mi_Tf&7qmQ*Se
z;F)H6FE!dzaMJP0;>Ud|edU718zyh&i((!nH84ILd1W9`h**&z7j;bZeAW4cjo$f~
z(E$PRyHu{d2o?LzeUj8P%Mc|UA|Fo$z~@jegs+%hH?hQ00;`T*WrIVdsbs8U9lcsd
zufCY*RW)$Y+vu#fI<4mJ{$9ViwXwP1boaKloBfu%?r!exwcP#v3e=Xmno7j&Tq4F+
zK}?T}`})Ew>Jse$D&-Rd6W|PyWmLNq#b!;1z3r`DXJ^N2_IA9j=9cSiHanfx4lKRy
zey`gDT5N7rpaWBkId@b7J%zrklBZ=Lj~XsoC^ED<J{~jhdArqF-`?KqHutytyUnfb
z4g9OS+3aqwx3)Loox8tLg#u#NprU%qfNIV3BQ*rI3A(XK^f|#FHaT}lzuz~!Z|xaA
zZ0?w9Y;767Y;A5BzQkNB18sN1)Ps%feG|N$^(|Aa*2en2sp}gc!Au}!YnpG{t-USN
zx82>{9sUj11KoAko<!r|_A(ai#d*3|V3rXl7B5~h&Zm^hLgo~?fApy>&4Bi>ecg<{
z1-|LC4fLhL@L|h9V3r65UX6I`GcAf<G*qD=u1h@_c;Q&^_}gzykKYL&^zNaves`Jd
zi@q174w=O3Rob$HKE1r;kCqxscr1bkZt&+M9KgSLx)bXH@g<J|JAYeF0D7%x;MryC
z%6z#((6A&4w0=3o-@I{AStpK42s%)&Wm_T0mGp)6R1vgCNFvKA6f>nBYani0?Or3v
z+ov~Ri`kw=Lm|;JW%E@m;Rz91B}zG|3ze{XCq>{)B9-H-hxv7Ve6q*6e%<i;>el@|
zdA!|lRw(<gs77N;>ddq{k9v4`6R$||GOb|q_f(cIE>ZOJ`WIRHzXDjTcopqiN_yuk
zCs;vz?t6X@8|qsQp&=JMU2^{~0}m#KZ1An~FCos0)kK|AT!oJzJ|V&LDmU_y{6T1(
zg3HL$D)~dlP6W^LBRu4~9gXjo<91SINT220`HdHK-I0ezU{Yr3tbAn&^V})@MBXQA
zeAkbM?{?zx+^d5T_o>LPAFvEP4dv+F^kkvMm#|29#Df}@fXRzrB(M{2{LT*|98x8a
z^2Qhm@t1H=08)IgiRaR>O^uGF@k8>)jmz}TB}051fh1SKr5e|4Bn4P<Dv2fZc?sr)
zL+Gb&D%JTntfqXzpAE?n5Hab&HWKWj;auR+Yr|2J2Q{2?5BL^9gTKgF*FbLsy5ob@
z;mN-*$gxI(qqI!`(2c%A4Z6t${`(QH!SKD_yL;6*R^mihW2|T5y|^f~90LPmp%Z&q
zU5FgINm)vZ1dC1VR}4i+Dx_ctQW^ln#7!0u`!@qfsq^I?7iS@UY0OlRLv1V?wLzK&
zL%>CB{vplcPbqZ2GYu<yY|c#03LTiw!AE!8y-A??7xX7@C>7xAuKXSAb$@1V-4QjD
z_w7(ZoWy;(+M9KlvPYyy_bh!IbNQZS?*poOvyXyl?fpENWCy-jTWf!+6Ztz{%5%zX
z;pxkH_A!e@oJfK?oxY?;{EMC)*M9e4G>XKeI3ib{H~7yZ-$ax+E8;3a+<6iXT;Ghl
z{HM@Bm8*l;zt83ZAz}}6@nd;B?Oph+D0h5iEsM3sYC(_HGXA3VRYbMh<;!%td>r@5
zmv|MC(P1#92^aJmWcLuw!Q-)(D0$(A^&LWW5JN3Zbr4><G<{k@3@`Hzp&83zae+`R
zi634P*O&j);=2~#l8&|beo^B4MPB|hW9iLr{;7rc!wc{F)}G6>G^lUwsU@ok!qb+l
zk0T*p=B+(57Lnr0o;k?Kxd+#8r8-V-5Hgfm@rQU;arPqF@`uTgj_)zFab=}yL_L>n
z6u_wusqc$+W)M{`iNWY<jHgcpCl-sRPo>PJ7BPrk+rm_dg;V*iXA(4@f|-n)PlulC
zXMuwYsrpn%wed(vh}+qa?!!;#=ST0))Tr*9c<jWS%|u<RA>k>sQ$+5v8fzcILJkoh
z0A}djIk2c-7YNEvg|~AlgWp+*H_}(MO^xy>Vd9U<T?4itZnqPBW8)RAO@?X+ccvE%
z7*mh~2R)}`7_zBJ0U@U{^RwXh0r1NJU@nAyFo_aT<}CcW=lA;n2)Hy4@I)x(!^$si
zw4vgHB3-w8!|r5=uPhh>eb~fTFB4%w>U8HpG`Z&S*vf);Vf;V4Ax44{1u*fm2VXqI
zGfI^tEyaBTY`)+`&xC%9afgI38OI$ZqP|DLXfnV(pu^Pi!F~BS@7DS}gXCJB?$#y-
ziFUU3F#q8GR@2?}`pxa${^rI`x9{!jGXRBJk$pb|jSZHQU~cp=jx{p!KBoS$apnh?
z#*v1Zts~07u?yN<D(3Xg>#Ri}%p<12s@1UXc*8(Aj)>c0i5}~yT3ALA4b}b@3NbCN
z*UlvPvPk$%W#B5YlVL5bc}~|y4~Z*G?B|}z7El&@q-QhE##ozWa@#_4ddl6NWopkP
zV#{VX<c#r(DKo+_$W3FP`F@=y3BMHS&lIEmzUuw~ia)S9;&Q7)Z@lJ?{IwtiNea+N
z8I_LAytz-x$A4$y?(Ls~zTf|f!+k5GjAC9W435fRm{?=hfXz}=X2BF65+MpnY!GZ#
zOioQ((HTw&oP~Y_J6Qh@cPuCjiW>ihe<gVWnLFC*++dcK*yCT*Vb$rs)hOchuMbB^
zYuvOmPHpgsP2o$xW;?`4UEd|-69k6kE1LYgc9)`||Kay|n7}rh);jBe&3ik+HL7@T
ztDL%m?{>@RynXBb9*=Hg{a;h|ggGpB;~@c!I=W)hRXrczAJ`JDVEcEtK6B-cM;TY_
z6mVu#mt0_pZ5NY0!!pPZ0Gz5K#Q|+y*sYD1(?<jR8mG4`D3QusA*gkS$-HuVEoqOm
z>~EN<lJ`O!3b1ad`gj$_l^Y<I<Y~N78!r<?Qi?7%FH<_2;9+L2!w?M<XENpnB*b(|
zuaaUOEpb7(V2nt^z~{%0HZ%Na#`euY;P&JfcW~$4GkTV?dm3$Zc)!#fJFn^F0<-J*
z{XLxpmu2Ey>EhGx?gmCbfIaCn{G9a!N~qfu8^f2a>e;?Nj+uoqr@ECA4RjVQp?kfn
zj_FV@Q&7r*1hdZsU}r041cMB()|Jf&3URRY4~Y}TM`s{F9+U0kEelqzuc1Ij0_-)k
zYAl}X!mtOuD1HsgxJ!RE)bBrqw2Q@+%|;loAZ?hciGuM}Cm&G8(8tgl!B^;iJm5a4
z4QNYhFxEux{#^h5XX`s>Pz4*g2q(riqDdDp9u;jwnhvT!`;yh{`P4~^Se@uJOHShf
zpGG$+c-Cjr&h*EZt&Kvmabx}IsOq!j{XXBuU%__&s_Q<i2uL?R7fBGZ>w}GcM9D&B
zB!H}x-kfCGg>FXP6)HKVn(-ww>HZ|;%IBqjcpaw=D7X&7d-8foR#=rbWxa%nYx|OK
zKX);sqHG}q%rC<(r@<dwlxW!Y3HE7FR0fzE16|npfJdIDhJG1-9R_#9qAle}n{)5m
zW_eKqyVy_oN*Itf8ZSxy?2-KWVjiFbEOJMrk4T=Jz-l;SH~M<z_pYv|6k$^uqDo6G
zqot~XpvqikrVfg`F1C-AJIf@}lv~T>yQCQ6rv90@drsk4m?X?N5c6m`hWXn0@vQ?a
zD7Ny+6H@8rDaJq|Py8^;xm2weBItCZei&JoFBDqkg~HS4|2rw8RinJ!Yhxyio-M5B
z!0yA*A6I?P>qQUB^ku8_WBmy%0BOueFEI*2uM3MNsw^XvsD|zo9{s{SzPk6kS6#p;
zP!K6s<b<OKBEMV4GMZXgsv!r(qY|8T^LCTb<~82jscu3A*3%ypWTrpG7)pPU;}+fE
zGeq3RD9+k|^$mjI^|Cqy65zYr?C9-hm~b>AZNYzoat^ypRS#x+oq_r2_58`L4bb+w
z70|{uQRg_gvjExH<_Cu8&yb{OYU>@-_w&*Rz#=)Dkv1Z6+EB}6qEpnCm6GzdORc^p
zsG@w8p*Q$n<-HQZB4&p2HKD=96C|xc<;Gs%b#dQ3hmQ^s5fK&GRh`cA+3A0>x36cX
zbK$4=bkcbdy#KvRJ_>VD$0}S1Dabdat_5I&u&A<S-s{uaGw5KU)oNW}<8N-3uT?|C
zK^Uhxn5Gq6$%ZDbL(eO0z%aK!Ou*2@0B6iQaok&=nH-h)I&|+1puT+PTJgf_wPw3U
zMv;HHc6FHcUmsLS6^$|xHUk|sqa@ldl0ZXr?rjoBK>ZNro(+i4%UHmi!8olJeMG)F
z-t!|5X|O=xQ4iKL0ro@Dq8Nfux5|7H1J{1U;b=ebj%E&+(=^dwIEAh3=-CVYZ%Pq}
zCH@hgRRqMxaJj~e<oXPScS*ONnu$IICVGorM4@-(qCy(^(bc!j2j!=l_VM*>m?~#<
z{lLx$`$2{YiW5IKGVYd@64~lpRoB;K6W@LiDgZDnd0~irD;7C|MI9;OSa0L;Hk>oj
zb)}nT{`0FJPNIuoEY8Ae&Qo)qd2=4VS9iOh%s(j0Q5#m*)GRnoEdSZK)XUhj%)pU+
zBvaa=ma(!16I>c(o+WM)j)KSzh?lWI2|bFQydocQE38CGn|*JryC5Tm1K%yR+3jyI
zJ-hCBc}WD}bfeL#aEGC^<bPR<c#;J4?eN^Nd$Y#>gU2CjOAU3-HI~-c%xMy4mvmYx
zHm)d^8LGzWr?w;#%UFby!T23UnRb$isSBIqfs2cPc}(&TjU~h!j4YFhHNPhP&&gC&
zYC?tE<^RAIFs|;B{`vBSh$hC8s?4aKY7t(V`)RIW>L06N>6?m2ja~8pDWxXUA;V*a
z(v55#Y0Qj?t&}>IcoQgAA)K*w<Fs+z5Rk-5N|bG%pE{>O2*R8SCUYlUu;GtKW@X^;
z<XqSuspAW&5;Q7V5@Xa51l5*UEPsnWl<Ol#s2@^_bLM37G!+(^?6pzrEoQyt+6x|3
zU4izPj0<O_r6{UIG`t#4Zf!dpUW7|qM<;H(zVRrJK;U<4ePm(bJ+QK#)mo&MD+14Q
zN|}JC=tx?4eq_3>i*2}~k*zkcX@5Mik4%&i=agDF!SFgCkSJt>6ol6{81UIP9*|AI
zKXZwt6th7Ky=%R0ECI0+85oHLsMo33%rz=ZI4#W|mARH%$f~!&^e}!CbT=0e^fZ<L
zYME8Wm<Gl&483WM=l}kng#Ho@9hUr$=`Rei3KiR&10>H_K^0*L0<qE)w=u?O)s~b>
zl8RfU<Poh!z^U@?I9_1_q3Ty<-AHsQ-#^i605m50b4sX-JFcKoDR(AjFT<i)r~1hY
zoS*P^4!_G41>u0USZdYNR9tF}#cpXC^sWH$4|`B18l`fg*%>G=%%FLTD!uV8Otpx~
z%&JQ{tk%n%2B{zAHw-#ye*Kp0lp8r98pQpoF-hr`sZjn7-7x+bb%XS;E4r>FcJ3SW
z<UF98kCsQSk9$s@!~HF7c)xyA-@I9BP|o+aYy(|DXvY1vNEI4~S)#zWj2~%a_OEQ*
zW;@5AXE~|+ymXE*SaMq8+zL#EbF)(XtMZ;*#1Cz#(k*$JuK1ypIAtgyIYED^GQy>X
z5G(8@|5uR}>j_zbT{!bblX2`lv}j_Yp>?a4k=_+{<_gs^Tk}VA^Ks6QfxT*&e0|=L
z<0pfV@2q0+?E$R<8KAYjdv7q{-Z@h>b{yPU+bQMeljDGs=g{+oN91Jv@DrlD&r|Z&
zy2<5p(@hX#kr%@79#lJtn`Mf@4Ac{2oRKm_p_7#MB`@hEl;<GS&buCdh<@)v1YN~4
z&jOQpcOh^ji!G3DL9TT1MpI^?F==^8py^5$__4Ik2g~KT)k`WYhDFo>Y=>y>-BrZ3
zk|Mx(X$!>j!qD;{jRUs%EldryLILltl!}-3@JfAd=j*7)RuwWmSBwQub5z|ko2n~G
zWGr!R{i@=yjBnbpPSsU@w=EiMYF;ZpKQEoRcMKLge-fihlp!Ayc1jg7k9=hiiIN`$
z4b;+U!mtWvRry4+)|aO-KQUdos7Co5wPbTMzoMF$-<HvheI5!qu8ANVzq{v?0PpSk
zyT=qv&L-H36c-BMv}1aF)p}1(t>0oJdG>1k>|#pmD+F@GL+j*|X#ja)pt<`PW#?iJ
zRG22w*7QlOn5)fkxky$Wpy_j4O`l(@T3)LuuD(#9oCH;~V<|vNC9gCq<+zkpsA(M?
zmYnj7FQnv~OiZdyZEqU_RFzknFj-~FDFwy+QC^7&p}hJ<J$a1@mqcNjDok3INI%BA
z%#TW)<%5gU=Mn6h&PP_qATETSQ&p?Ey9xY<y(NQMWE_Y!IhAIU(LvCo0Z`%&$0s@7
zQz0duiac`AVO1=AHQuRP4{asT*l23w)}puJd(6L42rwPl_Bi20*Flr(OyDEVS+_gB
z;#phs+daJrhQ+W{sNE5QtE}gl+sjn}+sJOsT8x(7%rwj@<|WLuAJywYd#s`bGz*fd
z0z2Y0EhzbA)T@S)39D$oq$_SmH76z(pV2U=tR=H$GO;r9i_t_j7RxipvPoe4&ZmIc
z4$7%vEWl}zcIHnql~fdf^3fbWP#l6Oo*)Uq5?7#7Ed@lG$EhxeFXj;xscY)HQrFUP
zNgYvL=XDWJ-PnaMIh~cIl~IRfS5=TCfX*4l2%bt0UE85UlReQkoBxL5H0hJY>6KEP
zPi^H5pUhcKp(?pa?>`0|mVM9pbVmk+fBgLE=zNA6?F`k{S|MGWE8P^elsYktt_~;>
z{M&f;71CF+pr8{%5gIGLe+aD=+GK(-ZgdL0l>tZxGvISz6W0g&{X2tZ^anhUS4gvh
zg8SjpqVXRPP>0a;R#aK_M;L^S(@c38vKI~K;^H`dJ01_xM24rPvyIO1SV@fttVC_9
zm_u-Q2((Ias+S^T`~BHPO-2hD5kWRG5(2A`kyW&l5zC~>$m*rZcyjRZeN9Ij9T7uT
zLJ|rqQIgfnAte^d(2~_m5%cGZi_`O(m=<CZhHS)SD6B$EUeiuYDwHNBubCp|Nli%`
zB~PqmJgG**lUxFxWT<zNCEfX_TEnr?4)9|m9-^-b^{Aemd{87!KdO}?;K$!;`dR4r
z@i!a!0C`oYht=%F`}kX$c33C9_I_=@tBGe@e1IV9>O%xpAt0-mv;Lq=W&u*Y6d5nh
zkAAAjXdxpa$VNs&U==d5igq$$nKT($y)+qrt2c>OD*k5OBO>}L(eSt29U>ITQ1G{S
zf5^$ylUBJ#!gkY0m;gA@lKV;JWxOv@UY=y$2(?Lh#RaiiNbq;%on#j3J3jN+8_lKo
z%&3LOGKsg`u9bOzad9jU3DC<EiH*o~+^DNs#|ycDv?pQc4ad$QsFO3ZlRu*8N3KIR
zYp9X*=U#7U-MN{=Y?~mE+bnO30Bx`|#Lww|>o2CE<Rp)lI4w8~;(M<QxuoZXoi8eS
zME0@m%Vb)cjfUj}1D&i&<zk+1BI(_^_Px#{?awfev_Hy|^K}+!F~yV|pK-a_38&dg
zpc&^q)6gI-tIEY5l}UYO4xsr^=aKf}N&1xYxE0Lf`Ev6}kH)i!k#~x*eQ0jh3?E0p
z(y7@PeOyYvuQPz7#94mC@2HWVUb8#nPGp8&gs6N@%Y*onnfr4$Oma{<h@znDlc(VF
z>BZS%`t&qrE)G&?dTcRplAnOt{RYxNDv{H(>S{@t3-jqLe=NZs%ceOl0C@Y!^WDXa
zWz1*9PbHEuHl<A;*f&K)SduJtGURzm0o|ypi-K;M+Xz(dJRc6cu$uDp8IO16Ro^q<
z=xhx=2fjZ0yvO<6z0P`U3&N?h9w)A0QUbvZP&BdPb=KoL>v2{w6I4;Y)>)4Smvhp)
zDjWyaS&!e;S&yq2ChDxm#dX)m(^{+QsPjzNnXj$Z={he{LcC7bStyCb)`IV;Yrd1i
zcV?OPDxc5PNv|ZFI_Xs|pgQT5+-%oLuSz7na#HfS&UzKpS+BUlvQsN8i=nX0&b(hA
z+uDz9k4_CD$+unJdHVRbz)o?%(4NT+vdm~%(k`z9H2rn5)8FAb{XMc%oZc%?s@)}v
z?&PM);8|~hO(_G)3D(i6(!gn<%UV+=^tSHuR^!dAX-mH5R#(l<teX2<wfD0oZg3@Z
zsS><UY!2`D^S_=I3IValswk~>f<-y_uc`;k_R`jTO+a4RI;9qnI9V542kR!1Ur!10
zTmCI}7<vx+GYrEh%gsP<sG0#Lu)^_G_Xdw@iruEELRKpqWW`C2#X}3%a#lYCoYTQl
zd7z@E1v1W^N`Tp<)51M<DN?d5)DcxPz!WzkTBNuca^gNzJ=ORk3HjBC<tK6)fYm@B
z3q1AOQnnO~RsyydEOv}|YFh7VHGY)y#aaRhZ!Ew_pL@USn9Lo9LTOA|G@+BEU4mm!
zdBbp~y!gCy;*C-6I%hai(sJauwdGKj%VIcqr4$=(qS`t2-Vt|fGKbCdkP<bHfpAWn
z5speHIFwRU#h$7o)wg>tfd2AOA;BQu>ww@X1A@~YtF!HU9T4o#Fd%pm4)8y9L~zB3
z;Du!SjhVatYbbz_synL9CJ?NS2YxP54s|?m4(mtHq0S)q{p!x^Ty@<Cl>q6s=OPGT
zF~HJ@u1x0KWT7$wKvqhJ6ldBUVH%Yy)No8S;|r$J{Yi?I&rARCI!+r<a2@bnO0vQ#
zTLKM}fQf7Sl5IbCDWjrnA>_+1!!D=6A6$}Xxb_M5X;4%IOcmAqbr{?Yi?%eEh-Q(^
z^@HyX5Sbf|mn44nD#cqrX?eAn2l54k*3&zYpZ;uoilf*hUFtyUdCEE6sH=;*Zkd>$
zI*@t_!`Ai_=jBy7HztM#ihO-Y_AT0^ax-D#s?vXpYtf!ckQXs+HH<gS@_HFVlloD9
z!~I6{>$ha5+{jt(N*9utqQPh~a6|b!bi?>#)D6<Vt_E($8^mIK(38{P&L7`6%Olqh
zuX^49T_C*hEv1e7`b~ZFW~uSd3GAibvV?R6PTAsqTU>T&9A<Z27?=6<3P)!D%EoOh
z19-3;d3|0wM;OjA!eEC>F-%3$vQqr3@}6Z^hc=XV?WEV4#y9Acp#*oJ>@VfpnM(~J
zR@h7auUV!-7tXxVMCkfYMx;s;f0g*zm}(CxPVFJI&KWW=!~QGudhbXvEV`ew#LWgh
zVu056?!Cc)N4`$g*l}=YZKqTWZO$GwFIe^q-;8B-u!IiNM>DZjW!YYEou$+n=}S~i
z<{2PcKuf73WG}V*$2vkbC*Y)JJdMR*Jhgpm&h{-ux&9>_7<dYd*J9TCIfzXDj(CN?
zr6#|-)xZMjqop=e=5<wZcWMoCse@!_)*RPCGE-Y-6)4q$WDc)g6Y{Rz2M(?Q7NE3%
z3tR1IkjfMf3sCv>0I@j74;PCAR7vAn)o|*_95piM8AakelqV~y5R2i;s=a=6#$KWG
z^=RFE;)eglRB~_J=m!7$9JJi5OscNDO`$6!2~(fq=9!!q=M=Y$!&1Iy54+{RKHx3O
z=Vy6S_T#bps?2?!#?&IrzP6@bYWa9=O|7k|PlNN+isrl(O~sb-GYrdQ7KKkXgDQN+
zrDv<nFlYo(+c;|*X9~g;`xXUCH5=zVY?Zi5lqNne(SpNuL;E7Jh?FAF%R*V(Bx{@G
zY;BSxh!@Hz`Sfj*8_#3Ux|o`ycMD7m|9B3n<1Cf0DP(<;GPRAewo%fX+D2KB-`9-3
zX7q(^1n+TNCKip~YPYKyO2yhFp+I=)CW%FIyCOEAv{5@=C9tikjkS@ZHgZg5<Y21A
zLRdL=NS!WALD03z^lKwU9MSlui8dp**MnbFxV1j|{W5u_(~PYzrK~I$H-6;cBEcq{
zo;Lz+8=(${m|j^qWW;kmOkgXDLgipIT3G?r)9>DZ)`}Gd!955p3b4gGAH{NX&Y?Ab
z2x9ph_&QczWlZSb);i&jrvuN8JcmU5^#m!59qEf^+|kJC`yr@fsGWZGypiLN9dC$(
z>^Y!m(M-o_F^PCxF$msDObbR!%227>UhEg$p#0@8bl{BlLOB92$Iu|q{+sW@w=Q!3
zF;{qTJHtDoYjw9otLI~H6yaEbzv0%^);iz=W?B*>yhBcs*6_DKWWp6;-*|(OsR4Kg
z4fOmjZg!*OXjcXFb8mnmSU+dzX5DEgj%)*W9dz9;%?>)(V_oEZa%6=MVQ|Z*^1(OY
zQndAx<)A|&7aD3f5d-WF?*S=%pai^2JV>sGpWa_Mho8>RkKUg-hX)r200CspSI1fY
z-@ydNG8i}=&k12Yh6oQP>JYh>+j)&RhW!x1Nuk$Q+!$~iSVW@R3HtED9m`&?Cdr9S
zdcS+!$=IWci6!K-es|pNS7aCzyKm|RvQ-IN9Sz|O>O~&>?c91%<O1dg{#Qf@7wGuC
zd*cDBZ~y`_f^=MlcVfURE3$>QirA1t>5yIkEe7A%Xhdrhm=Oc#9(skn&-B6~DfCSO
zJ_QJ*GVm4}ZO@NJ1NYwf22voHM9zSrh9*fwL+kndzDL)QGc`m-8!@)bpDQcK!C|7j
z;r!royaKfI1aOu50_9z|d&B1R#+Gvf4dGgKBEBwG73c)*XpBoLnp|Idcvq#$DqO(M
z&u-XrIH8~)9j}j}<JU|?C5a`bADgwffnRk#!He+DkGuwb65|dDVZq%{pocmSYB~;p
zMfGD}*d}stznWsmlM$@Bfu1?G)|1?E-zFdb{?Eawkmw29kCgL57?Rx%Bygv@wYjmm
z-|TGdxy`M;{jH|E>-C%4z5UINoo?UT*=GO>wIcg|2zoE96v6fA<A8<d<5v??WJ)v}
z=Qc|3=*;`)#HXaw2_2Zg2<=x|Rk%$VSs-EvHZ>9RER$OCo!425eAM|bV@nRJhJANH
zFAK*Jv0>V(v5u;Rr73!-_BX43N((5DKW~)T9jJOfN<)jDFFsvk?zOcTB}^xbr`QN4
zBvUwN0$e3_JhwDgp3Qc;_PkbaV`F!#xv}2cY;N^;`^~*px8LmT_4-@A&VF~@>sFYq
zQii4`D!zB(4}3^ldZLrm#92?)M$z#EjW;=k)9?2U?^}C@51Tut8e3b2FR;uFU*egU
zfwsG0>cPhLz6svW`j)9yYh!)i)b)+6mJy_EP4jKLwYO#Zw!6E#!@uEjaPbn1Hk}z<
z@{M7sbt$$z<`GjD1aDpUcHLgT+w8CRyyn(+uhYD}Q_v{E7Nz;y_W5nwwr$(CZQHhO
z+qP}nK7H<;o`{Z#d6<dl=$EX@h<d1(%F5i|T6<kvdv?vFZe7*7v3~8EnsrSYqjD+o
z;y4UBLsyTQK^>F~QV6UnrjSt5)x8$D#iak4zjKn$5|o#M1Jh+k+m>~kTkt~YZnu)f
zIf+=SDh><`*42F!lZqi}#yOba`{sZIzo*lTOKTMKGIBt51Ddxo0Z!6!YELo#+GLu|
zIs~qo%htBrZ70`^z(NXy0}FcRO+qD&sG_$v$s~&`%%qWU&oH6mS(V=gZ^??u!2IXU
z^|#nEPZt)Dbf|DwB{?mT{}>sb;PP`=2aGNky#%eBoRcsw#e13G#GJEzVD!<V_meaE
z5JnZ@tMf}JVFKrhFhRvKo4XU>=s7{abbKHu<82i1*i9-|vJ81-uy;b!OxqckqGdk2
z`5Qk;lv>qHGlkdbQW01RNuxhiilLm!PKA4RDNqOQL~BW|YPpmIMDm3UT$GA+LI6r#
z6##TGjMeuP1VJX{;r_h|2CB`tyYWo_!q~d+l<cc3X)C#)3&#Y{Iyfc8cJx5*+0+Vl
z{XCak`-8Jv)9EKI2%oI8=%N<3>pp|?VI>gGHf@lYg&(~d{1e*tDDm-rXWjMWT0wBW
zss2etYxGLW0La*88wF&|l;JLyugKzX>}MFlrn~GShKuRddnCo#qod(CpFV&XqZl&j
zo5l~-7%(RVFjVk*u`LiA<-?!;tV?_QOg}Ox17OK+`4Vc(D((jRg9&N7Y)^YHTyTIr
z*e{d^qBg|w=1*goYJvN<(7%*wCr@GQvg!W3|3Z5%t{Ygiyz)P(JOu3T7lS`e=iSTh
z4wYi_v_ROX^f0l5gM}H#`Ms~%8C#i!NnhNWRF$ZE81z)=fOy>pH7h%DKqEj2k_p=<
zI$&CHBOp1Qa|so(f!{wc&&Wo(Q&KkluTaPdbHm#FD`@`Gg&!+`AS~nUL;a?hC%P*y
zOJwjY$5uOVQoSjsMb!Wue!o!$xblaOv5bOjKpnT-T&^u0SNYoB%9G}bfIBeK>yw?y
z@sZ+saB1Y&b;_b7G-nYqCG@{Iu1sKma>J`c)P!rYYZ?3aX=o4z+Ke_<<gK<N`duin
zih?Zp`pLpH*9wlwY^rCnLnv|Ga_gHQC6;s>p9wdt88{k|Mh6aSnlei>&e1P~EbbgY
z<F#=jo9JA<^TZyJhiy_4mn(f(qmkQ+t+7ZrGI-|2FXztV*1P9IE2|=De8W|DX#&)A
ztto~!&*zb|!KaDgo6}2&n*8$G#pSj0@Z*#*W_jak@~dEF<0>4&X-Zd37-ae4%6Nv;
zX9s&kI;Xc*R<CXTu}oHvEd(NK5kW=Mk|#x<=@nY8p)@WplTe#XBAv6+JvXp6mQt7g
zm(NGp!HU&j#M*!d+!ZhOxBb#fm(EkZluj!L?@CS|aIP!ne<eaFcyYHV1dW8}&7RVg
z|2Gk84}{@AcAHWcRf3jciC+T{LB6`G&T7kwW=-dyYk)*mm-Ca4&-g_#BL5MI<vO_{
z?8Y6|z^d;RpzqdI4dVy$cFV%)F$iSAOlaNj6W|E@5WX0&u4AId>&fNoXaU^RZ3Eg|
zC%wc5cSFO++WPKC(6LQKk+JD9`t;TP1W+fgb6*rCmc_Enkmj!0Y*bYAOfi395kNhu
ziZ+oOd7%tAFf=9CL&ntR7Ffho?%k7cyY_o>x33Qh4-bd>rd&R0TKa2jmnXJvQ!5vW
zzn9#p>gGBDE5oU7-lB=V{;u_i-PmGj&JJP3_G6*RajJn-He+LM8<6f_5Ye3+W^zNk
zR^Vj^AhLlh_0`H<tgA)Y>*aa#^6<P`sYxj^)iJbTVoF<B94VRskrfb|sep9zHkMDo
z`G%B1l<y1SGzT_(W<sq$tDmhJ#Y?#79W^P2t6~w*4@_5M26P=(D8c|T!V#-Nro~Hs
zBZeLO3Vc_70+le0Lr_?N(%M*LM)%%FA%dU!F6OO@h=5lIZaytuJ16g+=6qF=ajv9a
z=p^GM@1M770pBcLC+j8elxsHY@vggb6Ug{CpIXdDT}P>DpS|JR?C5f2fCkfaUz|6Q
z!bV|AT_XsR7M5`ii49Urz!-dZN<BXqSLfbdg!fQYJtFbnPeR@8MjHmaSIe?VyX(Td
z!IoJQ^_IS>{&wxR5$)k#_<v<ID7t8K9ixkwSsXHh*NL)HBcrGzj6y5wKg+4YhJT{$
z88P~X$d_ap8C(pUxa}Pf>Ek4R3mSscgA!;`>LmU;F`}kq${)CX@YRRR-OrKyJe@!z
z%0!c>WGL{g5Oy=aEol!e^QjIkvZ2Odb{zvMO2TRq{r@2}Mf7y*_hUp&jP~x1wAOLU
z4<X8sm?_i|43-ds)qz#Kha{ZWyu$w%oAJo-En3x@_MB=#=PvIAx?%W(J}W7upd4ZD
z&XT>o>B`;>k=E+a+&ZY#`Tv2=0H^(*rZZ^9bI<6Z>LHOfvw(?a)%lV1AOY$Z3@c(H
zRjtL!iOSoQByr|6K(Z-rV-HZs5Gs9?SE7YVAHNZ*!1)Xdc}jvh+YX>9k{wJ8UVqSL
zI9KF!_rHVJ!asBz93BNLRpgW$Dp=6EN=)XvfQI?51v1Q&CnHSF^1JDSPH8HiN3#xB
z2uYc$Zcp)BbWfSZf5`g`<|Y2;SsHKw-_}1)LK58|^wI4+^kJ+VtJqIxLB_kmX)mAb
z3{YpGo!il8+v(A2W_L04?TYPXCaVNYC+IcRCLbDNrhN~sLhy)Q3I!wWfhcDBHzj7v
z`V8Zln#?6HZ59!%3nY}i4M^!=yBg(hWw+S}TmHWoS&}9t^V(Ow|J`T?zRoVYx8Z1i
zc2kyuFAp0$n>#F*j+>C|Dl89S$EP!~epM#7z%~#gsv9BnEq_yDn_3CRG(Q*PC_0${
zDyO)a&O?H(fE&EPRkyc<;IjuB(HV7$8(R8sC!{}tx|P2Zv}18ZYAqvVwD^Q1pp;5u
ze{7Kxk2>v4m9C;515E+A9;dLwO$~8PG7{jZga%;_T4*YW8E*Zwjh<y03beaRky3Ya
zi0Y*yr>+QBOJ)37n*oh`M!{vyy0Vryp<%e=r7CiWvDadZQ$_7#r`5c^!lUN<yW9D6
zmqGpdTOyiPA=F!ZokC^UE;$-Jf&4>Zo}VU%6sAgFHARlt%Etrq33(|c$})LQL5h{_
ziK;T<!{*P<`dLBzQ6|LTLzfpX<o#}KpO^H&v2|dLxI;ld$<FSFPvrkAn8|MXe}EaM
zo97C{jH(%!##Pxo2G`H(mX*d4S%;SppcCTqOfFSGMM{Sn4T?OmSdE;`Tv_fa2^=l<
zn`+X6YSJ5P!klW>1M3{4SCi9ppGi+ym48B9(tEtuR2a(y2mIAz<xCk-aDg~5{)nkW
z=5%#}r>O|h`nczDfiRVZ`xW;xTb||=exss_7_F$?(Bz{o1bxoN8;8M&+91-kjDE4~
zCR;ae5sT=kW-m`<m?(n^`7R<5HH|r@wzMjs$8O9J{HR%`CHkuLw9s8&<vQ@2hDfw|
zYVk^_>+rSa{Npr*I!sB@>cXGI+IF0k>~wW+(V_gt)alfT;mL72QREGE>N)%=(tro9
zJRnmp^0LqdfHINI4893vMFoIKF{f{S2Z&PlKw=On?EuLZ6a*98vQGTobTRqj+KM|#
z9jUQ@*-0)rYa-k(M(DlA&Z?=ZqByBKDgucBoMsqA?vy;vHeqlwufki_zgUq=#d2t6
zYLX7TEh%i?jAk4mmB*w#e=(fZUwO`!aQ-0tK0K8bJ^it4W>VI&3UPL*byiwdyd0+Q
z<ZK@t-5YJHi|>sD1<gT-oL7JN5i+ltCq)i+C{jAFf#K&&2h0P`YUiE5+xx>@#J3;N
zEtrXlvJIbx7W3ENzmZtSP9#OeFIZrmeI_}Lz-z&tmNxdN?dSnt#@OAGbL$)?E@e5q
zUvjxLk^>|xjK7Mw%#(t#buUk6*|<3#5z&~4h@c+okA?`>p9bm7=xW`}XfklTy*20N
z1w;m865@h-Bod7oY(>KY7#fWk6b8TEc6Oe+2nzyIgK<&m&_T-KW0srYVnGYT$4m;t
z+~wqEg~wsZ(IiV|?g^58iBL~6jl~?lN)~La8vs7mLxRsr`MArC32>3c=ORrCAm8tr
z(!3B~Jin#{_;|GtPxTqu?zp}Zi!hf(tGl(=u1xpV5pamcT3%s&RG`L4jw|>{V>J8~
zsf35ae;%F8Xf#H`Kx<>-e<X&e%AAZSRU#>2MJnl`%`?fo<j`)Fhp?~?3D$3Fhd?j^
z2GlR=Ei7A_$0Egw*qSXS7}6h^rXx>Tck~PC<V4~$=AWBRO&g&q1jJ8mSHiTQ_lPO3
zXF)r1E?U!_I>~+NMl<6L9ewOE9-xOiVLe=WET*&4r8^#4+zTmm*ZvwikduRn>x0PC
z_n6bUDHKz}@Af5hH7AQ>x)l<rW9G3HVjfIN=sWwi?bi@fQufh2VkvM4zxQo2UdmH<
z{iCo@%ouO0SGu%i!(3gKetx1-nfCO9G;ue_YVV4B@fYSv{HutYL(eP$O-Xv<;ZIst
zj(uhgNT$Os6D;gvW2N@BLdLS$DL^K?3$6uSZm}FkoYnw$E*)FkvpIJbhDRC3R@kZO
z%)J8$bxvl?!dS`k7bh^gWcG>JcP!?|1xpvxt+462NciMgGj}*&MhBnU5HWa35IIyQ
zuLl%uo^CcxshphA=^=hd=@=R?*#~6$jvYR1F%kz)Rc&f;2Yue`;~3I)gLUQ+kbheq
z_nywQ`lz?)w=&@$Bc;vf03RjcV3G+%GNIful=+y>PV)2Aju`%v*{6ek=qd`iya#tR
z-4`C<*xA*2r~Rv@Ij`)wovZ4xR{ZRLY~>J>lmub>-&UDQ*NmsO3D*pj>EDjkD(A)B
zo`bBXYS2MH=jB}{=cPT;pm5exTieZtyQZZwmUAvR=VQ|{r}l}FWcbQCCnQnan&v&X
z^OTFj+bq?h?(su9=UH;FB1!iIs4_`+V#YP+xl(wMii{-hs#;AT=OvPgnyY275d&)K
zdiv|7q2_1(^?VsW(R=G8r!3A7`Wgis<|bnse=0ha<mQo+e@Tyw>j$THX^)6&<e~?t
zWK*Z{T-G)dCiewxJ()2-TOTKf5;hyHvzo<3(C&)Xj%9Z`v-Q}@)@5aTy0W8B#f#7C
z5KK)ljdB2b<n-Q`@9&jH0Rn<ob>yNZnR;^2-%8JZYdV{mHIU<!8YN4>h$NQ=mwH>m
zkC$ZpzLPz}u!6IEz9IVP#%-AA(8@phKvdXzE_V0jrRz4Cl*TQM0;<`^>fFutG-fYC
z{Tw*dDd3crn)pZC6(H#{oHW}?X@n$Gf;b8+z|syxg(8tz1Z1~DD@rkRiSc?d>b`_!
zfa<W%4gE@WG$v95<|O)21BPSaWu-5*sz+iRdetQH_oG13&mC`Fu@l<{<jJGOBFLN)
zn<VUDDQqxilTmY0WV;wAwN9Z#Bs5~NT3T=>9n_&gYLX2Hq?I{JcQ_7Xq)zM7@DvJ1
z7!YU8e-6r>1BEC=RIV#H6@9wSfX?aQQITLCd*C2)8S&X~8aTIl*Z%eEf&mUBI{^5r
zBnF}u4WTREx|iN@)fWl`QPEknX$>@R>Aru4bRs_nd{*!KjC~0cxL0@EJ*%?jBM%vG
z>qQ#~fCfw*b3SQ2D}zQ!1Ylg^EbdUcgIKE2AqYFB%+#w-xsz9{{?YvmUw70D2)YKi
zS3*ox-AFP|51HQHO1JUql*ULoi6+?l&3NsI`8_}q5o(pEp9dx)(yy#AqZc-?Q*SQi
z6k(3Gq0RTc3y{#U;4X1!R;Sqgl9Z|z<$<rqZ_d+${BbciTE-qJvseOGoLiQ?^zZ8^
zze<hxr~s}gqqnx<bI{dIaWXPA&mUh4Gu|tdp=3iQt)={FYe&1O0P#RvQXO(%qOMD0
zVE&JGXWNds&sWNIGA8?^)|nuJ0yCNvm@T<ah%K5=bO-<E%5vYeTY!2LoQDJU_WL2G
ziQDn#zVZxq9&`|TPjR!oZf}{*E*0}{cE9c=jg+|BelpE%+lWcpsDbNRh(m^4o&A4h
zJfn>M;8O`}XC+R-2iQa~uI(s8%EUBOBYl*28m=zpLLO_fo;eoYL9%}&?ZGF16?=0!
zmJtj?dXE2Qnov3)Ok>Fe*ZwsYu4H~ti^z+qc#S_?#udEECIDu-?h~wgi$xhK{Nj+>
zww@;fGq<_h#e#7^zEY0C0e4$<l^mHry;gV%H0isaQC9_*I;ZzxMz&H(y#Za*kjzQw
z6<#sU1#ARuPUaMRRqXPsCNg#clC>ONQimB;+G;zs-cwAz(i;p2DC>8pF|El98b7`Z
zS9{m8eC*PKrH<#-v}7{TRYP?vTg6Y~6c06>alj#FYB5m_P^1w*z29UZxZCvE-^bJk
zl!R`tUx@{)kbbBKNYR5wh;sV2Z(!$7VXjqyEsLF2Aacr8Af6TSXe@+kz^JX>yb?3J
zM&;CtTb&`Zeb<vFc^i$fz3-b7n3|a^zMR}b=@d+)f1$9=o$zpwb(mtOKJj|3*ZREz
z-fi^uO=UCT!|ke@+&;6ArWw4pvbroujayq?-pu@DW|ylmpVeAWwx-}4s+TrZcsFJ$
zA2ieUY~6$j5=Cf<X=-&S#g}fdQ^;3ta+n=bji?f~IDA5)Vb^ABrbCJnr+Dn9PHvHD
zY?YW@C6x$tFNjW*+hgr`;C`)+s^IW!>mR<4JIm*sRs6^lTqUDW+9J2YBI&8HNe2D!
znK`!-)ms<6#~m{<TzIc>?aC}ru9iW93Qn_4R3~nuG6a^yYB^E?+N#`C$KtRg8dDa9
zE0v@UPB98wzGy@N(W#Q|V^tbPjKQ*Ca`fVP7YWh2D%w*>8oPZP+J7DF!hz-Y;=Eii
z+h%?jvYY2VR72qSdo#`#7qm~+{0yJIWFA*=`b%=T3jkRDIOEP8xm#VM^L3OZVTKyo
z^r}!D+Y+<@aW8QN?B8^<fRbOxVxHgRdUYt1X9YuCgY(@!>HK`xFBn>f`S<ScQ88{o
zK%eJPH_(WdRxr(G5pL?oH*9?LrA>1;@!DAiStNDOZz1S_U1^6H0+3AI;z=)=p0^y}
zCzDRDD=LHnq2-Ixv}kOjwK1&m44eLwK{Hs=_{c>1%?*{?@n1|L6C)p^qK@6czeBwU
zWR0azvSfpB(mEKIjoGD?sj0ebsfL-gxn4VvqzWlN+Lrg5Qh|*#|Bh<_UD$vhV^b8%
zMiE82QT?<%p<+Rv1>ity{=X*l5TKsA%dkG1Y)25kNB>^sZuduv!E56fb>}mS38FR#
z9^cpjwKoOb_F!w}eCuTo8}xh&TK%<DW#2wf7>;&tzUu+t&mOl}IKVU>wsfsszCbnl
z0T^%tf;6Ea3EZqdM5G%yvUW*2TtEf%ES=dHtSh--7V#p5DqYw*7K30JyrBb-AO-6>
z09!=1F9N4EILIcpoyUrSOB!t~+#a0)2e{Cj!^?1wNG?Jgs+1xfR{f5U3f`anMFOJ=
zm|!m-9M84e^ihN_Aq4C-12!LUA2R>U`4TL?;vHP_AM2h5T~OKiKSyw-VnDc`)SS!q
z`V|T?bC5jpg*yb$H(^NqDGx5pkDb1IVUj-G#1w_*Uj8Q?J6P9*SZ#P5v|z`gv&4gl
zLMC;4Z(Y3oc-vg`K-c((8Qli@Ns!0jF2gwGN18uaEU|=?oX?`=Sa5*C&#&LO>T5Tb
zWpI>%^*yDA`ROnRW(cRrCsmK<t39uT3=}LU>_uMC+P8La6k>KVOGv#=v%aSWKvj0T
z6w&f%eTE}-!VZTGenB{{VF5mM`KM(VEa2EIHUXF`pkU?FPoU6`6oa(9?Fh&TESNts
z)fw`yXJ3__;V##1!fr}e9PP$LV6!vREE}C_g^pUu^n?6UfU4*aQ^>-dw2rCP)<HE8
zJV{EO_HbV)$eAdjwDMNuritNdh~RU?2CcT5rHIUKjJ=S8Mr%wyln|_$(ehMuaB6(2
z@i^;kYX8=|(EGAp6!ROshGcmo_oFI7_IN?1<})6X0jw@MnD+I{fr)|wz40*aeE8(g
zYN~t%s^O&UPeD|)Kb+4u3Oo#Ja2!obFj#my^A8j|1@D<BAs5MxkaLI65gUox$rMq`
zb@tC=Dtk|!3o7R>2I%ebO;oqrKrT=m=;s7`<Iw3k-p%PfTKT#cJ0<9)Ud5!HLm`G3
znOf24rFPV3FN4lyY}(}{>FlYR<+?QTZlXsa`tnBWQ`!wWuc)_QXa#bEtWNaz`~kYj
zyVwDOFq#iXZsOM%a4R;R1G*z8usTaUzllB>6ltxvm3%3mm-7aC+dr4OUVd%Xa3UFc
zFI!3-M@M@~TS^LF!Wa-PDi1{ky0>UbHA5E8vS|7xeOXmk5>vO#S)K}N`_gS?ek)H!
z3;jK5MY3B$4T4o1%h6dve6T^g#a37Po%*GDzbGzJ>x9BIynDmXiBuMtL@ak@?55#|
zyrwbBSu-y*H3^)ovR0ym{CRQRw2D?l0TF6J{y3cG5#l>Gk%SYG*5G(PgPD`PUn^#u
z$fLGnW?)kW-)D*n)HDu$In@b2E<+lP>KmXp8=r#gr6VN>Z&KWhNdi1J;%TFT7FVf$
z@j7zq7$G`~11g)6(}LWmXds>`j6vZ|MAnj<+W!g1Dt}+wrGar=`7uKBH1;&uD{P5*
zS>?^5u;MQgu=lHyre`$%C7Bo>iDbU-TTWaTuOU7(4wPmOEk5=jA+YF;ut4mYT(^zH
z1|=bd%}FvLNp`UjM@z>+S*ht{Ck7xuE5ce&e_;k?jOt#|-UD8=h@5<?7A)hAVEV&B
zw=ju^N7%ky(vQP_gpW~=jLA2slsf)5M^<w8Kgn6M3EVd3Md%|fkB2z;`&9j$+#GiI
ze!jMOtl3WMxL-PR9B{Q*vjfFvaTE75IH<7zcR>MuF}E1*zxK?opSWE%>2P%C?!`FU
zyMvV;e__Rsz45s^o3?%b9<bobE<l2w70EJ#t=p~-HDfGCA5=%o3Wstp84Z7csl?Ah
zI`2Q`;>EE4<a0%Eb0!~-k?V|&_^Xg*@*}?60Yq)#z!;kIm(Je-nQ}6iX3zhlpiu~V
z?^8FiKX%TubM+!*bk>+6upXbN4lsxM8<1&HN0;wH9=ZESx*akROgN$Xd?EUr`w3-+
zyYXm(-h)Q~g+BA^@z2Nh7+}j1a}gS_tmPv(`LVJb^%d6<cCLhHc<N~LG_1~@A;Aa*
z0`C4x2k|xOYN7d%7m=0FzT@sgl?bsv2W!DhR32y$VW6iH0i;fV%VxMBSzT8>F)ul~
zO)YB{EN!e_S~6`dUAx;h9a^?lMMt-8=|zI*=jeNmUX=3q2aQTZpX`&~$LR1wY%U+1
zdA$eOkLxvE3&lnK>k=`51@>i#yH7bXZapiPHEdm9^LsTfJ-SUzy$xIc4A*XNZ>_J}
zIlgwOJaP?~T4!&LTzh+0)@|K0vP)Z+|62BN-l{t7?cA|)>CQQ=we6&y-OM&V1=8pS
z)7CO*owfaYe9QUEYuB@^qpf$z#`Z<ar~ms?*2&JQtE;VL;llR0tLd8ikz6WF>jUTZ
zd9~{*KZw7qEmKQt{_01yZEf4NZRgk2Z_Mh(o#}?2Q9&w>&C#oS<?@A%lRm5M>#Lr6
zr)T!>+-?hPTa3|#+CgdQWEx3hx8CAWg~K6nPNw#@L+jsR3Uu+nR?^1fgkxE=&TjaI
zFE1;rJ$pO@cv|9tEMbL28jf;VGFAsZfZ4Z$eE@#;2!r-_gY&Y0w0^&<Y6dZ3fH9Ai
zR&+HkmIg6Hyp4#ffpL3S45HX5Yj83J6ykyujH~L_;L9h<TiR;(%tP{s9~2FT;~+)}
zqj{o$n8g0aX!=Nf+03hIci_A9HGsYjKt0J=6X`Ccy1tm)RV#o}dtE@kuQB>GMaVoT
z6dpPPB!&osP7tC)P(a7PaC~g7d~0kv5`ynbkZ#f($%zu7Iox`&HV-=#9>Bd8LVo6n
z0-79OkWA+E`LY>DbTx=tcf~}4hz$4j`f*I9N2`_)HLDk|^~W6;O(5$!nvkRBVD{D(
zBt`eFRmZ2AR!nu<_0&8wcAE<6DTu8~TMkpJR1XVSgW5mrHU_<SUWCz}vW#+t=-0%_
z=aQTbonM4zv)N9WBveWCEj)*s6pb|i{XEY+{#pHEzQ$#>R-^?IgSbTRdu4(t;S827
z(F<2w2iEqZp(h>37_i7WCQW0H<9ZARd(N+A?7zcloEap*%~q$Jb8?6|2$e2=Bt^#D
z6L5cxqqshsjy2}Gqtu-Zz9tWq2&+#@HExUa<c86-rd@t#B3wht&>xb^eEn33C+1$V
z8&<edkWVf*6TqbMu73I=fdS6G+4)ISzmC#r9vtU-9Np2R^8kv^GAUgKme}vQ8i5LS
zd$-S%|CC2Eh2)K_d%ePh-hUu-rgrplq$-@p7Y(hvYx!2ncVE=oCu60M*Xb8f1!&6H
zk#_qRT6cJUcK+Nod8nZZMK}sq;9-`AL=%Hd8mPlT9gYi$qKw{8FnA}vrduzUBzbvX
zF>2N`>3z7dAg*yBHo<3{pOH-&(q#5|aIdES{Pggd2h5E#kFqVlySKT;OB}{Wzz}Ox
z{OUjBZSqRFy3Ln@Jw7a!gFTWeRHZKhXUzi(7<<)!-zOZD_3z^hg_elz6HG+`#2(E%
z+SG;NvggWDfUm6>^XWYqpNY&!DGr<G9V=$b$lMo(UmmAs*4H3w84iBN&e_j3X{TkP
zVDAx*HwdDGMx5c(K`B`ya=`)hjluAFc@>_%ZJxPxSX^bL6v~nX%gVBr%Ze_2bMw?}
zfCk_Fb-BC9-9@Q*9p(9woI`#>mXon?9<R=X^K{^rTyNN}e!j34oKuXz<|Dd-mMK5$
z%hKaCUL@SM9OkGlW3e1iuT*HnxaKD}qG^eIAcrqHXq7`P0fUQXmqz>s{v>w>M(Hq(
z&K`#=L@CR!%*L&RD0Tx@1V+tKM#t5NPYvTy^jS%-EE?>b*p1?u1wWpe{tD{D%KA#^
z;rkLN$=F#~d_BFAYhlxiyR6KQ^IdMSRM|vQJ!+Br(VUiHD6|w%(N(s}Z1lAjM>Ign
zh($&|=5YR6jiHCyCKk@muLcQQheqy7BP`T<@80y(fL#Effme_;XCZlpPC0fZCs0j+
zlMElZDh_s^_L3K@&gYN}XOp2QaG@k14fhs$G^NLuUDNTlaBEtpU5+>1enT^xvpV(#
zIZ4scQY%tj@jp8ibA<fh_M*3GOP;U*4Q&n7T{)w%!K&P<AJmD$@zH_eQu@_k(0QDq
zntht`tvS)CPyXmw<qSI0BDNdvP!D&R&5BE)z9S6MyqzxP=F_q$euUA;RFowlIyV#&
zQ_7Bt$&jX9wPT_fJ=xew0v#$>ML;JcPEHqg;5&(WxCz%gf%toiXTN0IqtKCf{5Dnq
zS#VzLvztU{g`l;KK2~dY6+f2^<E-04*>dnQBQra-J^dPMtM7Y!+ef^h`{VeSd-RF~
zV?4WJ9jr6;8mW8z$SZVvI@*x!{@h(%N*uD>Sa^4G*%lfV>f|fmheq4S#9jou5*6yf
zwmAIwG8nt--gOU)D|p+zh*+fe4OD-5;>7%-&z^K^zeF;)ytxFc7CXS*j(u<1`8>$b
z;|-mWFxC4*llxlb`S;H6_sNgNmkTS}zo*pm#zMJtImB1;JVxvYYlb-(Df`xe6obx5
zOzR53vah*@nA;(v{*QAC#$Car`>ZK`mG4uQv`558i#@7sm+l$oo@DiSG?FnEn9EKJ
zWMno55m^L7gb-bf_4Jrun&RW6P*}w5q?)>+_%%KH?B$B^SS)jYL1}&$&<jeMs<x)X
z#m><pOIZ-8aKj}I{n5F~sYOe*duJQ4YuG!>uO#hxjO5GV$R28>EAQGL6}`yWngsTV
zQj4W}2*^c@k6bK#GN5G0>SfVdA*4B}^M%4<yyb2#-v<bN(P3>g9cECvj9%6I!hMsq
z{g5bFW{hb~`Q{~Cd?lF{v~r6INwfY9q-+O6Hff-^{P||s<Med_02*4yaJ)}A2PDI1
zhi`9|bZIkf#~Xbo;7y0po4L^mH*xlGgJBdY0u1WB7&@KXo;@T9%!&+<f`g*rR{>uM
z6#VN^0?DD_HX$NN#lAQyp0-gJWRou98M-c_aq@=xKVZCs1|U{e&|~B<+VBVXufR#d
z2{u|hARiIBW8Ib5H8_by2f?KR;Q`t(O`DK{c;v>11WPPDcx1H#Fim0DdICG9YE@8+
zy95HE>-E>ntnw(rtmdM~%_c~r<B>b-EHmsaHM~q;EBHD(v9oX!3op|MM)Oe?7#{Qu
zGXNp27lrFjI7}lBm+|Fc*mGcgb+lq`VaMmh5(rqXkuXR@!*Dqm22-yJnLxYy<84d%
zbMD+k&J!(-#638P#St`PE)hZ2al_*e0JVU+ipF8KnVF{h2jz3&-V#zeDzU!k9Ft<+
zZ36kds2cPrHpUpd5X=k$7NQb?g&<?H;`L`94)6iJc+umRL`>&|3p9wt5!hrc(Fi29
zIR8YH6#i`Yl0z+mWR5@M(O>tEa#!gG2XGS%k=)lxzeWJkLABD@D4w$6(tOfA!%X&<
zZ-fHQK1^$gtK`Ds18XceAni6vTQ4$)N6ezMJ$pkEHs}U?vI^FusWGrY#S|9=61}|_
zG?O}->lmU)Mr+{-X6yc27!V%DqF|EscUvH&ol>9J1BTF9yFl9&s4-VvXs$RQ(3b!l
zC}xAhz!X4;WCiG3_4d~U{Jn)2Gy^)ClkEPptyi7okQE7mAb^qFQTXwdGTv1E!*HMC
z@w6tM(DrGo^!XPM1GOWySAhiQ{pU>65FQmro2G)*!#6_q>zJi&0B#l!h9Lo0!mSbE
z$YkRTI(Q*)`Ht4Zu9Av$unu@vvFhE=Xa}@4nu2W7N$m6q79RbuIn2U<aMZ`ZD$zm1
zG2+S32n1R!&uIE(CzGiV^JQ<~gPngq6hJf)z90wbqY}=z0&YA5Y+g6DPpXo4k+w@t
zB#u4US;YgR<9GWpkdQ?{$jBiKk+VvVN_!WC0`pWehqU@=JIa*s9vFLl`QV2m)-&z)
zz8<PKdg$hiDYL&>-7|$fQ9F)T$8mj7yhi7mPj7rv12|&~y|I(yhFrhcsqe;`zJ3uO
z?@ee@TBq+KITi;R4rVOSJOuR&vd!6mk@OBGqGu+2en&5?r^znAcU~Kjg?{WR5k@>9
zFMay%yFuo1D9t-uGHU@1&-5rf)dIW_DeZ>7USEXZGWI!g7xOOfM*EJ~Ci9|@YYPYM
zCP<!lI-HRTE+1^SfJ)N(Un|i?-NMZhGp`2u{&EKes)IJ@*eeQD2d;kwsc)oR$~uDS
z0vWRb#FS{FuBY2YliMc`Aolvukzw!XiWv{)B~yfL$F4i@ZDuxj3)ia$krCr+9}!e7
z-6YqWQ1G>l5!~3?sB1qRT>*|lMWLcmQLCzdW7MlVj{U2>q*AHiJG2he`nwZVEms=7
zKK7ea=qvY^`zrt*83BlXc#pi|8&#+#0=iLam!YuQf?!#N*`$JtX$2GkiGjvKVdH_a
zqnVwq#>8OtOII{L=9+!7BRbint8t)ra36C(J)#^_j4Q>zVc^Sg?t1IRx8c4gQPJ91
zMJB;P{cf^CQH^b+h4HBk<OTA9`a%8Tf__i5DN@7xQ}wG==x@-Gaaok&SFfy<cqWZM
z;-69=DB+j#O9!kQ0We$$=6?m#cdP^TH#+q~^=j@{dHO6p?w?TIEAE%{O9iYM0nmLs
zwtNZKDRzK*pZx19@ohO!w`t=s1)R?LS_U8um`;ofs;?tp`UP;kG=zb0VpuW+GU?vF
z&)z>-I%E%d|JnE)!XfiyIuU7Fw~}!ndN-?}wny%-3ed9y&{Ksk<+L~d#QVWtC!Ja<
z@MzRKkgb$HsWqwWIA7j~!L@*c*^x-`)%r`8Y~XKlw<asXTljr}`A1<%YO*>;?)lX%
ziOO**vK`&j<!>F~Rdz#k8G!8EL$UTdf|&7pL_HRYzy@!})l(>APea}LI@}z<Rn#?f
zPM$<A(<Egbi5~!1aF|d{@*!pr7z*So#@D#63T>_~FQO!I)audgNGM?2G4xc8vYQbd
zwHim2VX~E3@;@Jv<m;8cx7Fk=y6W9%yqb`=20RCD!-V|Tudn8>ZtcKBF~^FNQaJkM
z?)u@`Y1mTUA00~=4<}08IV%WXIa6hk*5&gK57r32?4QXoO`*r6JiYARKs)0>+i07}
zhu>=@0>Y8Qwww{F(;nMX9h|o9z1ru8TGn+`=sERwMq=$X-n#{b@&&!u-s6Lf@#2F%
z`X^Kz8EQe7=>_tQeDmlL(YV@wv6IrFiu$2+%+Qlg<k`wfOLiLUb&x};nkwsSj>2Fp
zE#cQxQ4p2tNzM)wrZP%q8fP*mNzqB|ii!ayEg)lUO;rr_Q1OFy#RNJ1ot~Z8>u1Rv
z6H93GYIiY|^o#Er>8URsBq98hn#*iuFX0^amzn(&iZBl`rXyh)uYjC6MkXXoe?*xg
zyenPJ;8Ll<atGeA!atYrbdwNu_Tqy<oxa?5`vu`83JPBpgS&Y=QbfAuf(dk?I6&d3
zLKgHqb~}FO`2!#VX(!98&@zQD9|NZwP-Lj(ECGmOyhF|HWQ$$LtrJu1fjecS#rMma
z7^)B50Y&&<b4I~Qs}<ffCL=Yt-{XIDb@J0b1<|iw8Vf64#FfaDgLRXdYjK9ee_<{2
zhZ-SI&wX2R!Jm%xR%~D+tLHUmpo*&7F;|p}BsKG;J1b&uBMTL1nx}t8J#yvFQY*A_
z3!FsjYbSy#P3BwU=1OWfq16_qoqDBdR?Tla*qCH|fUDPSFAN3~%oJu4jlevMD9l_%
zMCfrzmkybxJhL<AA0g_<u6y7#neDdIp<n03PQv>PO_2f-e8-N1xA`HWQwwwUChXaN
zN0Urk3;3eD_@=oG;K@<#mo@#jRQuf%-<~BwL2N*!#TQxLkP{EL4ytL&2yn3Gn5Z;)
z`slXJSLU}Wo7B#)!)}*m(dN;#HaBg8pxp*#b^&p&gE)Vly=o@;TD#O5<{bS-`AotU
zL(64H3IBU-B(S`Nvn$$46lXv3(%KlMUHi`d+42N`?K8K#UP%1A=n}y5?niK|tJOZ}
zW5b$$b)LGTIR1GR0<*Sq+1%Nhl1@qED89I{U7e{lioK1-47)eW$VsGgJ$DoV{Uf7S
zw|x%3ZDQ}^<-^*J4Xda=7i&ruG&NvNDOwNV%Q9eXk{hP60s8kP3wOi!%)4S3IneBQ
z2<G&`3UO;%b;^e>!kfNw{qkY2AH|M-9{*Kx@B^9dTm~<t>!=b$<zXrMp2D|s8^<m1
zO7b?g1+W~$)-05YVXG1&t+cLWCj0_3!y*ZtaJn&oym$tlp=u6vjKe33!gd9Bb+D9G
zASIt$wE{Ec;u@u_E^hK12M2irVQJK&H>+7J?`rwoD<?y)use#d15fkgYRt=9@Y$ZD
zI<AI<2W~E}dM0UJEjJj8)T*<*H2Jny2a-wPWCC|LjsC8SF!YgBd)gUQLY4R<SKQIZ
znK8*8vO8JCok35vHe!-Rp@WoiP530UTpQU>d2JZVioAooc476&pA_>X@I7AFViHur
z<#ovIwda#GmAO*9_u98<!*ig`I+5i^_G~ca!v3aI$YfBFl=?qIbr`DwjlJdcCqWeN
z(U)-t717r;qHzSy!J};!Sh09kQ}lj$_f=K6h#Vf9^?_!U?Ex>whdg>SRc?WMC^7B`
zlWVdW^H<V?Lh-nWnIl0$WF-b@*!dVS)YT&q1M6!(B$bz^3QxEr2HU2-cTlcwYHju^
z>V!P8P(n0bjxl-Ji!HH`cBa;&7{Cvj8Di~&T41}L`^<R4eGcHeq5R(iM_dYe2w1(?
zx0z#qPWZUdJ^Tr0QCsFG%LFTK(34M4+T^-<&+NpASElKBN{fT=<ZZ{p`&dD>eGbvn
z&z<9k*@V`aji0ooCg{ydpcz(iT|({*DP2ov;j=yR`y9nLpopU%UD-+7X`VTC>@Eg1
zy+N}bW-rA*Oy|u)iyHzxHu%>T_}!6to!DnP`p#TMxffGk#c84aj<@HkW?=2D(DpP=
zG`3elj7#UP6ggVi#quN^r+k5r6Tv{9XJobH$0*dcK$8ByjeI>Z!kvz>oaaTs-@LL`
zdl_IwemK){PoF#g+Ka`?zxz43f+MW-1eUit{3LZdZvOGCr0|_gBKNI)uQ)7=%gcL&
znVM!KY_bcEZq{CMimB!C(d3`+TcpD>=vdHi)_d4xse@<VsaXzx*!_{r0Rip36%0Vv
zyw8L{B;%5DJi2K<OCfi-d&=q7+f#(22KAm5a;$wL>_ZRch<~7jv73O*^+vU|y4oPk
zmZL<!L)g@bDCrINqzZg*hbTM@<Bm8Ci^RKS=1XRiu&73ZQZ~Zo53Gz9YM2(GZmPmd
z6Q1L=sh@nl_DWb&24*bQp|Km-mQ8*2@2Y*9?9}{eG)^kBvPpEKz+Idba#oO`$mx_L
ztV=`@+97L5AEx*%d*9=^=Np;O<jCm671V(*s11`}6Ixz3{d(|{`R~+SdQB+1{0e{B
z1z`r1yA})R-wmI;ncBKp&5%}ZPP=JVj<Ui;9rOLKI}d^Jvv#)#L!I=1_L{;e_^QGj
z*^yn5ND0(zSFa-9BCj=VQ@3U3+{QDVm<=$=p<rj7z}g2~V&~49K?ki5u3N6!mETXB
ztGhe-zDAY~;tf_rGnThR`INY1{=b^u^u7N0tx;|~hT|XKHU3wjd;#JG2ooHo@#2lQ
zWZv3QJbjHxVOm5epWH4gkYCcP5k=J91(KfnXEx~C+rOT5Vd<M*r%NmPl?q5gQU18?
z1VzS@J-+7XIJl-x=sl!N&!;Fk3Y9_SBj5M(Sg~~A4WV|n&30<Q=X~Rkj2N+fLUs($
z6f;LUqIv$~(fowQ5K}b=G&gx=e!p$zkLbOa95_haCE$NWFZLf@fr<iEtH}v)r1cpD
zZ{+nLI~Ks0VxrBXkYR=AM2T_4+LRLLtrnIFh1}x=y-uU?DwGC2d>-5UV4eb$Hrv}1
zd@?M+=}8=ZhX)WHV7T~s9|VtuRig!ww8GOZ%(F-#d&1px%M>3w(;)3PE_A4Xgp<k(
zail4FaOvNtF4#cSaKg`viylqnGg(TTWz3>vIxpYqPrCjzgRJXnL5*2JI#^ec6t8nv
zpPXvhu+(qY)9}sNZz^V_BDSjRI8LupKP_SoYBSky4tnps31h6>qyrs5w@SI|zR$Sr
zY0fNfWScf{h9g>k86a_*268hoCm?e|M&`GYk6MUF6Ng7!y<!YF$M}kp_CbPb!x*%>
zrwI;Yv}%stv-qFvN5gJ8S=g|lH5<g8B-~Bc+i`v=xjsnR*46dt)hE>9SU{e0ygF_C
zeaJ}daJ<;W??~reYQ!PhtUi1LzIj4FP;R+oJ!Q;F!)c`!X!Vvd+2D~f)n})`9A_Jp
z%+h5(BI=b>+Q2Wu^DFdIfqgjH-g5PsY@l>~2g^f3l$#<X1-4WJT1X)}rbQeyX;u7l
z$&?k-*O)lmQO^sNB_M#w7xnRS{YQG~iOjjzF~^e|8?7oyC|34aTuJn;U9JBx!&<qJ
znlTn4Z}-1tQq39s#?|}4dFG{lAqfP}afWY@koEBRgRs`5&;q-4U-+7Yj6O<EA~to(
zm<EEF0-LDG^A-i|6@n_uOvzWxRvAry%{Cf!1*~2Qb>h@lFsB_A+Q!N*N=1cEE7Tp-
zu3S|8F|pW-O$c*+|9bFfaFq14c7B)|{L6x_U7SAoOADb(i>_wm=jL^+th&5NcdSKu
zMZmYRqDaB4mSkd_k}}l=rBJIf-9R5>F@<n{l@ju3L-d4o2#0em*Go;F=jE&=Xw#bt
z`)am&$|*iROB_{K{=Y<bS7y~(ckaiHapqlvR*^mOPb?&weNf&`lbp>6>)t!%HI>+F
z`3I~;{lC1p(am*13XZ~f%eZ@jRIheo_;mB-7dL!=KYqgD3_REcSw^Tk@<+70-K$vQ
za{I6wvIMN>WZ;-LesJYz>1rSDR)AB(rV;aEkAN+se~@eDmn6d$QhzN3U51n}6{^BB
z;J;WO9_L;6%Y)B4bNuFborb8El~G>xBfoi7=&JN=6?*@`ge|qC6-Y(4*Hc)DJFU9z
zjKEi^w1il)NI^*g_4s&rzar&ydw)GHP5FMdREt8-yr$l|d$(7BE2BIPQSRpQZn)TP
zWdPeLu0-|DiPI-<j?`#bg3KZFE;CJS{{Fr0v2xquY{dWksb%>aK-RVP&QM5wS##~`
z#^u`BR`z5+Hhb$rI<Z(NJb5aNwo;fpob&J<@xgudJMx8Wi>eDEa8I$3iu0L$-3plx
zfKmzd0u&Ek*l#LW=-%=NG5Ha)q$nA%to&G}Icz7Jf#XDUZU5Oi&XxjnwynoaA{(g~
zER+la9JtIc-2-0>@Mj=*y||Sgc_yo|aXAV!lUN48rUkuSBOaghn$XYfVs&8c=MW0M
zBO%+B)6D!n)&xwQ8KI9h8WYFKx!9N{_JoEmaXsLN&_~p=e1jkvCNvvHd=HU)MpIHU
zGGf7*gX{$9$yQuiZz4YbGUAq5uL_l=)p1c}Av#);r+hg`l4t)*xCB@EQlQe4za?nK
z95jXS-r@@tuoC=u_wR|!o-WPL%-zQdYah=RH^jQmBJ1{9++H7d;g`3J3LtNGPJQ7$
zzgY>eGADltFgGoZz76_-)?1c?zIQqoNJ2{9K4KL()+@61R+@Xb5l;;Po`DLcFafM!
z6^u21i1=)N)pM-mUHN|o^{uz~YFlN>(Xtyg1}IPbMM8w@#Z%ZTv=rWkoloJG3$-lY
zmJ7a089iUG12?;fA&fI$ed$E$fkj<vyNB(jXGBvst9W$u;<z;Et*o8NvMr3JsY}sb
zXwTxB0dP!Gp>0DM;L6gyl_;aAy<VzTVP7)A39`w%Uvs~fB~>n)mL=Yh9Mx-u71geW
z8r1^7QFjfP{z{6XMQjE&s?uKl+6_l1jd$az6E-r;v*M_%Y8th-XEGHI@u}iBz6lJ_
zYw*pcrrNc!f|MRnzK4l9(?zhnheNZmNtYj=TXepbsvaW%+2k``A(`oP0J3{hliY6@
zwVrjaJTxxYh5$G2t_3I9lwIdB&!wLV8AHDE=Tf<UQ*ciu2&S8TrxI-&?G8yFVR0RR
zUGs}M*s1^)bD}X5Gq9*~VRRG-{<Ai@y#!w8(~cpw>%mZ)g>cDjB5&>ELm7^Gdc(Ge
z#VFLfvyviV)S9f~LXqc&RnwOS_KJ&S2FaUre}QC%avf3lq>7sXW`-BS;XG}H#Y=9t
zA_^N>1xfBjzh2Cl?UHv{uj3F9iL-O%ST<r4Ix|_o5*T-gQz}@x&8-RWn#eO52%7Lj
zaW=eWn_{ZpIW)+gi94<a%+VudWQ)BLmyz{B6Iiu7n2(KQX-IPzzc4Uoq2JD(is$K>
zi;U31r8B}MdT83uY{l0groJd>F`~Ft`O2C<8}M`!oPz2^#f#5k7K^&p1aaQ=QEuXY
zME>}Y1#8E{nn%OQd8dh~U!(r%)DSPv#~bgWYRADat_#Pf+7=wtthXAz>K9|QIPCLe
zi&NH@k}wr}Mfhco?QB|x>D3vp*(gKczQufiySJJNzs6Ba8GjRJ@gWJhEIdXdq6^71
z94?ZV%;r8Wb2eTqAL!JZQ&=Zn6lKJ@M~$PYZ%kbXQA(xIMs@*2F&6txrs)rKI1hhY
za<`?I$TmUX&1XUXB*7a_t~&8X$Dg33GF~ihPi5N6yCL52Qn}SQ+3=C3{3^P?wiT6w
zGZ;OSel|WmDrY{Cv7E%-6*5hA&`FIgxevvC%RkVatuTpldrIgTk5;wH&J|%@Q0~(|
zW!3!T$fE@FYU65gUE2Aq;WQBQRmOVU<YlJ4Ud-BmIQZJ?Z=1J58;lMyCD~Sn>K{b`
zAR+c*R|RhL_KO8Igtl9!rU&EhAE)@5#nM4gg`uK>!K!e!^ZE%=Kl^-sQe8x=osiwK
z-dEDy!vR(x49p#_2%g-$(8w@1GgiQ(-rlGw%z-aT-0l#4Z1)C9k#yvvi~wOC#(0pv
z=c8I1<}oJ?CDn+oORSDOmIO~?C3MCN51C#RyOl{I&pq-*k5I`$`u%#A;aqx)r!%R_
zkaDVMHKlEjw3*VXCm|!nw*VTmn2@j{#g9nL?hso*M49DZMCE%tE)qkWSQo4*QY2@s
zl~?}YQSp^a*?W3^@@f^0pgVv|R_~5hx*r{3+uftFx7a-z@&s*kGpuwcii1vAjyON%
zKzU+LJN*06H~Ra_tHlXC{pTo)3uxz`eDeZ}U;Kz_$RVwj4Hm}Fkb0YeKV#S5L0lZ`
zl?6Rz6~Ldk9cb$un)=!sg?9+%&M1b5M6{PJg}@%qkPO~(VYK7y{Sv<>Xc!&;tdT2a
zJMA<c?8mff!yKm5w93S7rgiBytH{>Nkaa95)W)sTX00IMRJ#X)7^*7V8xAjX_)b*4
zzcg68$jcHbDrKM5LlAC3NH^ptDWdy+L-5riUL?XBkJ!8I6B4w>Rx!$ztDrb$eL3~H
zOTwmFm&pQTW)>e(w{1bz(uBo8APK*<MmWBZO-5tvvMp)Svqv{ArGU6ep%(|4ZKQ18
zB`#~q;jpTjz*TTnIz#oiWLdOs$;C64!}594wClokdLaKQ^JZfBw)Km?`L-AY)DNOv
zKLUZ?H&vo7gTE8Yoy28lE&Xoy%C8wnLj*QB98#bKKX$;`DsfFwI#S)7LsiZrL%kZ^
zP3H5lYuJ$bJ)NY20PR6HuUYyGD8qrsrR_YyFhW4Zdt7_NF*8ZEjE9~q$6?I6%^<7+
zOLZz6Mzlt>ZKZj%M;5YH7<3bUt=6y~mQg>(MbsgCS-duBx+y^u%&qIb_VHi(?S4g_
z|6hs^s9=D2E~O1V#u9L^iC2pzo`G?po*XNlL@ra@0{V^EaDi!1m%M?%_BV^JLy#?!
z^CR7Z8FB9sFF7wM@IM&@pyGeUU0I=>&EJxm#oM$~Y=J?u4awcZvw{T+3Y+>#<>^`I
z#(VKhjOjuX3tjAb+oPGk-*s*f;nCo;=#0?YtKhgTY)9@~`Bq7R(cHD+C}&mIh}<3`
zmCIgKnJz!B1S;@4uy%iMb?R#8dZsei9!6iSJq~sLb>p`Yu6|z`By~bEnc31hr0>>V
zf1)}G{Ic&z{q1HhoG&?}oy@=dMaXx_Al-#j-^Ig}X;6Om7z3bGwM{j!NGCrWmQeF+
z6=J=>X@obzr-+}DJT|2C)~3d4%E^hTaLQ2aT;Dl2+-lsj%3(P0c1I_Eqb=r3@Nr{H
z&2LOVZsk<gTw7h=i&%<N**;b=gZgWfnHAg=rUr5!z8T5IjVBN59^T!l2!7N=Y-?(%
z!)4(#*<RnerjKX97kvU|YiTqk)ZFQ{tUlzF$|itGl+5U*8B82?V}3G+j)G}mfw_Kt
z5F*w*W})@ZQ~P$2o6iGfj*f12x8v7ypMw>X6d2K~6q9w>LyUG*f?`b{H&~+Mg~VK(
zc3;<VCl}_(a1T~!*S_ougglg!C_cf@BpCBW!ubL2Fen@*-(h$=Jdv0$ZBo3Cy3n#J
zU1Ag^zEqfeTu;9zryNzhOM#u2Ng5Vy4iJPj9<iV+I7_yn5}g;LM4~1;?k`Sb>}A74
z9nT4OD#4?4;IEQ!0~_Z$B@EzeI&DYoq1MQZe_r-&Cl82lK}d*M=`0{aqCX5z{6{NQ
zZz97(R4~*u;8`w&43<P7p$YYuPKHVtZaN_h;}omcA*jFC`2{AmU(Ru|V33-jb>7}T
zcKN{`Y-f{j8K=ww2XQQ1rC^F2k&;*py+s?y_;Hi0w$YmM)DhmQN5IXDf;T@U%{54~
z_IezA<$nNiK#srO%N*)1Zmd<tK!P#wph}q9tGE*jEmhRTip(U(naafb9@g?ki9JIY
z==`!KGL5GpWFEqmR7MV^`#CbDP$x+W$xfs8;4Y77J|da(GkFvq+@bLB{scxNF-xKH
zCv4K6AXxE^(>5vxMdhHV92Av<qH<6?w1eU?S_qH){AXgkxO~j_&JTBX@9%79D<Q<%
zy6;4#%^uoxY}ajctd`jtb$Vud+;+@Cqti5d_Mq7qwC#4IMepdz)r-JRlsnnT+w9ls
z9HzeLr#^>SOFG*t9|apsT3xr(oS3a<ziGAyy{<X1`aQEZYE3#F%Nbbipaivk;NB5N
zsK~?Hc@V6WC!>fX<NewHklh&T7?8zXAup^m9~6umX5KM7n47_hwY&4{PAzH~?;P$Z
zCTMcDAwh+{UjwD94ZA!+$cw2z{vx9!>*AdKz4%#C-nRTfQ%;>*bk<CkJB5_BEjeo@
z$(8=7)oo9#p4sS4U>Af<&+Iq)U9;I8fy5aPnw?U+;875`%O@;Y3b{!2l7+TOlPY12
zhm|O02CT}&f|4`gh*T)RxQnf%dyT)LS4s{lXJ&PBOv06jCT*Dzd;GF%Jn34Kmfbcd
z?x10|o9(ta8nj1d+jgC?)wCM+q>N7V+8?t}SM3pquX_mbDDrDv8B~+F?!9}tA?d_d
zElJR*eQsPr@d0c~KGBZW7gB<p6%i#6Rw-F`EvVdX%dy?T*c|o86SF;TG|hqCo0yI}
z7&Jzcaoe#*B?Q&^>yxJ}ql$>Aleg!a6jAF4q76uu^@T@y<whubC_V`7pUi?2{~B7b
zxeTFv_isD(otmzaiVlZ-#j8+*`P5tP>e|!*SPYFWdNyCXU)?G19o7a!)-Hqi(QJOk
zhBfiG^*IL+?Q+EGrC8I6RYMb3t-@;%S28hkV>K!Pe3t^)c1KpbJ$B7*dt{mI&d4_V
z9cN%p8g|pM2X=Shv`PqIkUH;SB^M4Ic};fYL771d4N>|;1$7~1a>J5Z%3FDR{tv|T
zCS<q@GfS!D^){|l#yZ%La#?<V5K>MZT1?2rkXR|2cP-~8-QJ+t8x71x!$mu|-2sc(
z0o!;4s-`{ewVi$$ZyqHN;^&A8Ia*+dl1jkcskI!g!zP8C3^zeu>8jqDtc!HAeezBo
zo@!HTQCf+;I}v*XBU^G|-os>fmy%`oBFcm=mgw<I5^jp{3rBlbQm~W^lS3VOf+68F
zO1LRgOmVfj)*#m)v4mc`?ryPZ4+n+EcZY~2mhaIVfdlqzjtn6NpTslsWL--GC2eAm
zI057vBqsv~k~fY)m3Sg2Txk_4?C?YS^TdJ)jIdIvoi)YNG`urc({PJ@O&bFg^4R(7
zlMEJ%bw;TH8m2r^XvA)IGSt%nyy=D>Q^s6o&`Z3)bx417uP>mrJkmVb5NQQ7WTVd}
zXTAB$Q(+tM@7SNyoZJ%UZ(A*a>}@*>_Y-JKm6B8`NtKfHuu4*jqEcx}k5s|Yp(lra
zQ{>(NvgV-MP~eYJyUDmG;9-=X+I?S85L2m|1$3!LbFskBu1raX^Uwar`_)um5dTOa
zX^-6##y_?-Z#KNJ7#d-CWNMlkZ`~!bqbLeX&KKi%=YLS5(6t1FUD%g_1}zs?$R?*V
z2Twlwnxp$KtXHn<=!Zlb6S@1mQa~fkD+P383aGI;4O9WODHT)!dv`i$rCB}-%`&1`
zN_)kI^+^=W0Ul$YE+470Y^$!FifMKIB&{y;L~t{g3U~J>r=PZxXl$#NSZO>zpT?u?
z_m#?Xhbm9P`M^pidSp6LR4F3VX&g#qn?pA$8%rdeZBjqdy%H0ihE94UMw%;!e=kbb
z!#L%1iWYw=CZ=gMk~A%i|E&ClJ-SC)-T>alp1%qhmFyUZF7YDEJ5ZwR>6Fpy3BApy
z%yTTt;@{VUECSM2y_s@fO5+3SjBK=Nnqv<CVi8wjtjFW~b13q)2`f~7#Vq}{(y}Wp
zduz08nb^sV>*0r6`ANb`+1^TJJLkKOF{K+Xx1<ZnUr&`UUX3m?)}?~kAj64Nl_a(V
z6T8qtq<!<tA&uA#!K}S<5iH*g>6M&(bBo``t8RT*A9&xu9ZRXm_A#u1+mQ|y-==CA
z_a~>_h@AVH*fMv}g7#pb`VhUgm#P%fqKUm&nV+&#D<q{}REyNaC@FS3?b7$azT@k-
zC*NipUQ<gesid@*h^6$KS;M)<$WBAs3Tf5EUah65DB0*SsSplDUSXRxYGph(Wa-O|
z4r7D%>o%L7i8sbt{hHSNTwdW6{izd#p9xr>$3#Sh-xlNyC3Z^(?^DG6`7l~BJoaRf
zf`vPW5->HwI0e0&mNs+A*{e^_el%`>Shvi;iga+8*g+?$1Ah@-FuG0${iF`asm*-Q
z#kn&*q$#fb3(}z$-e+o|t1B%_fcsqSza-<Tu>oWy6H{}r8EVQ{j#SF|T;LMrjXF5W
zzr<4IMpYh+%7amPFcL;lc`zyuM&+5<R?mdEDJEhqSAL7iZ&CRzw#aW$)MN32A7vpo
zpn+N)Y&5`LIVkell$C=bhecdDDDn~0mN+PMYoXuU?{ig>DVPbvr0HHRTz9r1)TP17
zz?`J&YzNxj9vmf4)4s`zvE&Y3Gm2fCo|C&k<d&5>1-g0TI^OEK6h9T{<#!nH2IR~7
z!Z^2wGUh~V5uk;gh!6VATkq4oJ@eL9M!>Ve+R?1AyFaXujPQ#qFECI`!!7`^b1-ZJ
z%-BQB@9%SIX8z_b&2##oq=`t`-zQ#Gr3NbGym;zgdSk<$&jJ3G2dic;@a2yA)W3m6
zBHlUd;|<pz!Ooij1-Vl&iKZ)Dm-?R%MvK2tOXF-xo|c43OuWk#Kw9F!r9LL!0*nD1
z(-+sB8(`rAJ{&NTnN1ADvkF)<KHqvszH}Xlc+n9}E4pHveKyY;jO<CH-7(wUM%Qc)
zoW9u~k9wv%X}RuT;yT@dO(`o+FJkCX^<V!UT1`v|vrTmujAF6E+ivy7UiHQv73lmj
z@JY8}_q&$a8aF3qyJ>gK0TOg`&}p^%6T4%N%UqJn1dfPug*41c?(>@5sk=0s)%Eqw
zkkGzyXgD_Pv-o@T(YEJUz@EhQoT2pkJWee9d(Zgz`By64GQwjK@Wv0p*w4u_-Rc5e
z4;V{hYZGrKoh{MD)xz|u+|f7I)v2>i)aQTtut|LJX3pW%oh*IyKkcq&9=g|q$?D(#
zzBxpCk=Gu5lJt3Sq`x7KW_bMC&@b0t4h{R#-)(g}&YqF|;-5jE{6oUo!+rQqIH-DT
z!njm_TA*%M$Eu2Fni5)4D2J9RPH1UylyY%hFZ~{KHM7nh>`vY-xja`AhrK~}-0QU4
zrqi6DI2?CPyEAT^eXH9X^xa;w*Kd{(hvISbs4Ns-&?g`W71+aOKIs1Z3Ocw9I{=!U
zPwkswC2=<_aRF0EY8mqOf8~g>BiX_<Kt}l#*e;FX(f=y_)eMl~dmkI0;g<vQOML87
zaHzzPjT}RkdPo|5eB8=#)!BRAWY-Jm8qtq?wRlH0)}X|SRePkeM;4#Uuu1W+PKB){
zlRmJR3ovhCrx-GlU<E(~CLnib2j;f9*)!l00ys^HS+gn{(!+@)sRvQnxmR0Lo8aBC
zcL#QUNLoD&dAl^`9SeE0ep#G5Y$e6Jg>EADMpZizv;7(Llc#Wlf2Cej>cs}s3k9M`
z5z3=pWNIo(bKKu+m~sFN5~S6$a;PoW!DTFGG#^^>s4z)r(dsQl)E^y6LTVvDQu}<k
zQUSbyCKw3dgO+tCRtD<;2sCO&`1cMHF08KgS(#5b2pJIj8r8zsN3qCzwFlAQ*0}_y
zxY|>xaNDZFecX{9pd?c(O*g~zqi9B1KE?0j4rh_nhMXs&dt4DsFE*cKosTJzT&>H3
zD^HsO<t>xXbEanSDQ(omH+3d)Br1y`Bo$R53nYc{jzH8HxWNk@bo;Wr%0-vkbViRV
zy4<?I=yE3^y4={Z=rStU7`Ua%ryOG@TOgPYBOC7xf)9Vkh?VhbH6!Up0j>$s7Vd`b
z_c>jFG1yJ69C<#aWEg5o>;q9}gV<+!@l5Qq$kv3S{rzZcn^i%jo-Tgrh;~TPbZKWv
z0cWd|MEvq?hz+A*G#m5pWX<#Oz%OFr#`(KrgH0_k{>ftERKC&w{(?WoZ(uaR0#1EQ
z7oTF9fW0(sKtAXp)eRX$G{3+@YaVwnm)!Yt<xb}Yzm(FYFh9NkfbV8*1m@@6tL1VY
zJU=)X2lKkex~&7F9Q<;?#gGXT4*aPrJ{*9onjI`jA{J;Fgbsm{fa;dW+|djNxj(U9
z`}=j{WC2#R<A0mc@lhy19^trMMrg|g5_XN0+B5&!p5jGE<14i6fZo4i76NP&bs0aV
zX|g|)#EG5?q??+OiQvvT{|-!il`W;CY_BlI<J@&;vTaWD?1<GG)}$X{--XR;d82;E
z=}Ays*P;38;kUDe=cDSbvFtNcW?D&^1lJj24_}H&N|TFBNu7#31$pS<kQGhQ3yw+3
z%xMs;5YgUbvb!sF!0r59RGE(7y?u51+lTi@7pL#uo}Qn7c!^*4KocaTEcb@&{#0Yc
z|59K?6BG(nsQ*fr&_#wKYdc6qp<2Uv5T{7>iS)DuIb&kenoRKvbAx;r<Kj0k4&C52
zhVdj2$Xv8UC<kv|o}7Mo!!&~_%lhL<h=kvj2FLGDFHVn-UMo%J-t3FM!Rgyq@07~y
zW;spe*YEzR)aBWoy4t^={`R|4ox~$^KBA=%!yUU9Q)JH_NraG59Lg!NArRIP%$>+J
zks1}lY=&W0i}^I6$wRP=rY=wF4y)2!?wsruQq9A0*2C@UHRBw{x6=9V*Wqcg%Twra
zOXCi9d+mlB1(qy3*uk4u_B9x()t<Xi5%LK4+!#4jvf-)92Fjrsa)EUJbj3muo)D;@
zK0Z;*ZWL1-Zz`*VKA2yO4*?96o<@jzUM_s&+Wz8_!wSSnA^A^g=z=h=VXTISK82;$
z14CUD-fZcI4k$bZF>}!+KJu4W#y9&Wc+MOU#tHFYrMN=^BN{(uXFn$X;+ws2jN_ND
zjNm4i`j^I6&sJPutP)Pv2Ba_RslA%eD>+E=Ztl)Z-o1Hrb_#uBY=WNJko+hA2?!b6
zGm0*0hOk%&I)D{2sMr{-md42ahCVyMtFxkK#a)7}|Byi*OJ_`QaNG%R{9{GrEDU9N
z1@Ol{z-C@QSfn(!AF!Ky19hiU!*(13SK!tT;P<iTP#;p@lQqUExpv@90YeLW{DmNV
zv6=}a@H0Bs5o|y=AT|8im^jnGw*Lw!z+v*<Y6M6E(pe>wU4bW|9G!KS=mvxdVB<@W
zFUuS5DX$x+6Vl%|FSx3S@k7NK=}zhD^crIjX6SG=FK~IG3r5tgJ-!N0&*N&@GeO)@
zx(4L!?=$8+1y-9*J)p9&yT2d73ozXK2=W|n0i+Droh<z8D3kq1v>`MFvBFTs^MefH
zG~3^=86Tm0cV^F^`;-0s&`&va?ZvDfN;q^?0!gm|_%E#J!DKaaZ1g6BSULcaWG;Pk
z;>{d$Nuceq(^Y3|#1ub>%x{R*G0^T8<SB7b3#TVl_ULz6DhMJo=oSn*kpC@$rF<l@
znoa{j2s~C|kNg!|IGBX@)pI~t^RA;F;e6CEUj<igpdkf`ck<JM@t<6779#)skqh$6
z-N#llM0c*S$K(^?`<Y99-h2QdEkYN3o@4+Ae5L5Hk(C^uikxeE26&y`5V1qnSoW@q
z2t<q=MkEx-sX|)+8fO5C5k?`{Vrn~>`Lu`}xpS}i6zmo3m#`O)#c(7^86e7KEF4Xi
z?ji|`dfdZsL$1e=454}a>@77Dp$vkL2uNh9P&dcs!i`B%E+4sUx2Hfx&JDlMh;FG&
z2x14<7{H~`!8*MvGz{vj=7CFffpx+<9gRbOv&RnIe%ESEnq#xkALFq@w`<yXRKc~H
zj@9psyCa8&A9D2~X8K-I^Qh_;9#s(XQ*!Rosr71@C>e|w-drenBz7c5Px*HQ8yc>G
zk6~|m_LBzHbcY?h;J2wivZvvf(#IdX;CIgf=J+Rw-`DK^f#f5SpyE$gj(aqfx=zRr
zmClody9GJdN;KdJ&~~64FKOFWXVmZX&F)|X3ug`brahWCX4jr{CRV@a^sO=r#|0^0
zB=+E2WC6oXB)S#KOWDl58lip2p@|G1nnQvRS=vT~tZp@thU55KfWc}cDC*P!-6t|L
z20>&BQvgVWyokk6-rKV;m>J}M8_rhOBX_Z@W{xP3IWpq*h=u^tO)B|Nrfg85agkzB
z@uJIxJ-<3w2<$$K98>D`TjS=aZQ5NI>B#DtgQhz+?Sb9vSd)g;?siJh(LcH2CKE-c
z1W`ydaQMGTtSPs}_$j<}jzWnn5C``|OY*m*wSEm{l)vH`EI$eiEIf?6733fZAe?iq
z{PD7Vr6i8Szhi%{xS=<@+coS#bJVaJW`ES~<4JqV?Dv`zv)^*9R;O!?8vT9=Vn3He
zj7;y{1bPptJCs~8Nu^2`vP78mO0OtH`aF<Z1P3%68-=o0Gl<~EhEed3L_T#}<6fuH
z?3v?n2Ne|9@dnKSC@78bpx?DemgP1|EE(5})Al)Dr^Gh*ls7e8z5p-j^Jl=7;rxjD
z@<Zl@TY6UJ5l~rc+;s+nQPZ^Ckp+UG(=hGUq+vSkzB6vLCjH)cRD#N=SK#zSAuQo6
zkV(l(Af<?CmWJ$FuHBsgJB%G`WVZW_o@w_S*X%j=z#8@Xy^+%{F=S5kG?1X>2X#wV
zRd((wksU{gUJDdjvY|?{cJq5Ko~_G(iTuY{Btrj~i_Qh`jv{?`RMCsaCnBv$oyZp@
zTUxK5Xhjv#PYw>yHs9Ibp%c+p+>40=Tx)U?uCOrRTZuTYfuQ!bc`J!9P?pEx!E~R7
zR`*GZ9sKf3_^#sqzK&7Qe}g=N-1pUUzZus)p2?iiE9bm;9_soo3yb(G@c-`AXJLUr
z?u^^6*=>N(Yj?*jv)^|ev)7(DAo$uXdps^7`NRP{Ra$%1RY@^uTX<E{XW5gIQZHit
zj@#pIuhlZ`rUM2+12%tqH0hYVNz>`|dT!rpmmwwUT#BS)N!w^7ODkQEEbXd_lVQ;V
z&U)#MB8Z+dfv!H%{Q*zq{UCc4#r`KO{6zDTJ`s76T8$(@<fw=F4>_u_tc@HsNs5G0
zPg_ysbzo&$_cOzM`l)WouNT2@MD=uAuG?>POt5EKsK>eHU<@W|dtkSFBe(51<*v;l
zxdnGhW1)`4&p7kFC#u#QV>HHfh#XBg<{V3k5LS@CSfb8Czl!tw={AUPJ|!9;n_-5m
z<=<fPgG@2jxHstZdK1%bPnu?X)U-|8wtMDe1U9nU?DbogQ-WgNeVehfM~{MFXjMiR
zU@+|dpugY7v{o{)L!q;hKkKW&U4SHp{^$1etu4Jo!by(Q)9A_cJI$h(4!_gydo}vM
zG%fza%no2NXLw>z%8VDZ9-{o`Bj`Mu_PTx4k`!)hz%*{H;=M+G+jrxTu5uEE=R6h6
zo4qBLm_mWPkeoahHF2W)dK3t;+dPt9E`L^R&`dU=yhciI_t5?n=iW1$(u9UMV?;oz
z2Kf8cOgQ2WweEuG1THXjO}@E8WHXtvLqTrHuQosxEpi<J{gQNjf=JhcCQ!7n$J8yW
z$z|NF@BbCRke_GxuVz>^Ljg|?w1=vQniCn86rdtyBq5AF8u8Ya9~@x55E|-%lp_^A
z>>l_A7`P*t1I<%3W@ykS5;?DyPTyQ&M@z%kU&6e`Xy&6PMUrH$-qeh+V=1Ll&XlAl
zM2U;EX1w*6FX+wk>_hagGn4}X$^|^{4da?)h5%3s{WAfbzp_O|`QQmR)|zsHqEWgy
zL(9{Zz_?3+aWr)oxRMd>XI%d2qs;T4J`1K7lP0ZCogkdR^;gsVKDRk!C`0EBZc6@S
zm!%+c4mFh@Mrt9Y*=%qj%X3mAz-4J7Pv_-q35tY^vmz(6hiLKb@~?Ygvx9?Fff$`8
zZ(n~mLI(eB<vDwi5r=%i<RBZqxD-QRB)k^m{03O@niVABMaGWIRiqhV>qB<xN~}j*
zKGh@+s)@91LO3;pkwIAJ!(v*?t8^MQnO^xM4DH~<3s1Zms-U}TBaLkWI#C>UHd#%l
z<aQNMZW62K6IXgkf|NvAkxO@`&qur{RCeqrU!N1d3cdA%FfXRt#8_NsB`|0-!9N2^
zp?!%`1t$__4Mb=|TJguRkID2Ot{J~E#r|gB#41Sf2JI#yg(Ha?EnRvd-EN`_08tY)
zj3Q*cdF7JpPF&|qbtg|ecj~<5_Cb8}#>T>G$Xk!c2#7tQ_8?G{1X^Dq1?C0Cl@^?)
zOhDpB;Jw@hQ_Q%1xc9-lG5M|bX{|SQ(w=mIfl{k6$D1x?pQeF6to8dydB_JkXs+ME
zX&8yZ%&)|*+IhQ@-@wuIm(;~-_GRXOn<ey;@W4~VhhLuHHuS2KI7X<M9z9Q(4}&Sx
zz|J1t;j>QCY0JBOZ;2m^T<^W5<PIWdKsBB4^W^LHv!R!~B21H)`lZ;ygVX+7H&IR%
z!9#Kf<Y7`bxsQ?$%@vSPDJ-0@K%rk*UY~}3dFZjnV*-L4eq@_3fz<3E$fQ^9giagl
ztEcY^RD>@VU?I449=s)fek}r|c<xWAdr6(kR#Umoj~3U`i-uTu8Zede1s;6)B(x!$
z*No(?%x!i~R7nJiq`*D*oLe;uNS~;~Y>)%cs=va_7r}uzOjv&x>R6|79qS-eq0)ea
zo+buCn2!fPLd_FK8)Eja_S`d>^ZT&bum)zs!v6;n#gr0)xRLKr_xBIx8$iQ}oXa?x
z&jUWiQ{uNF(bT&~*X!uXi4X#+#;hUn$4Dby(p0^0m_II9^4@J|3Eq+!<MF;X?()ia
z$h^<qonMgeY98D#>@neh95|Z$Xm5GssMNLZc#|8E?}cZS@OUD7-wcnjj%{*il-{sR
z50V%*J%+`UCgYl2gv*bBN!`;_I{<OzqxXT9k9{!FXHK1P6inFnr%P}Citq`gX!eQo
zml46+EzQ^?x3>`jswc6gWQoRDv!!RvxjhA;L&YFfDBh6`|2?^~K--IA;@)9T_tXvJ
zOU$l#kLS*|V}HfrpgX~M1=Dwuwy2G$PT{OKxzQF=3_j;zjSG6l&_T@LxlNfV!n4)F
zi$byukIqhY8Hdt&_5`Z%f-`@<nvz>*w}K!xw@Mozx);Q$nYY8WUr8-S8}vLhp^j6P
zI&u-mSr&0n&vT3}I?0vwLM%Zuv@c;jFC}Xnoel{ypE>yBG^(v`Cyyn8rmx9GmpD*a
zv`QqP9~W`$4^yU|(4E`~A!;VL(Lp6$WZcQR#+WNsY)SthS`!&5Px6gr`O3)#uTd+N
zvkk(GiKRWF*hbBjJI46o(C(;hkH#IdWpzhpd)(`o{lTbbcE%H{)pokhXhgw{UHJtQ
zq0=dv@;vme)>LKvoH+j3#Zs%0)GAUUhCK~0Lt=yNTiveJ8MMt-XJDD_2_8Z2_8fE6
z9oTNCV~-}?-i8KCul?1GRVo0naKTys^eo66e!DxiyN%Y!1i9ES0rQSI=)>?W$LjP(
zO}p1^*&7;uc*lTd3Tk1>kSEQt+nhKf(`vMBv)%4Z%u%~JGP{mt4O*7n7)&M`8Zy-d
zHN%w)Qij@S_4>`xpkcbbb{h}ow9P?h+%j#e(dmvSZm&NXY-p(bW@pV{qebd)i(mDv
zk0Hda{DvJ+-1;4nDum@Rjj0=sC^;>k-V0p#j_7=63}BP{>XtfVa2FWUql+J6Xy?I}
zMX_Z)%w@`{_eK365uIE8?D`wpSEgRD6x^ZgE1j{`aXR>%rPb)0?M|z24qA<o*=$&o
z_N4FF{hn@LDRFN%x+IhpzdZ<~9VM412{vtV$BzMO8QYGKn2*oTVxm5Uwc~8JnMba)
z`CU9@t;wmN$t)Vg$f4@2K)kW9<nKr+tUSi7X4Fu29y;vyz1^iReigxJd}HU$f#V$9
zz)#J%dVYQVJP3^CGWLRyXcC^K6KN7MIGmO7;o=zoH<r^YD$;e+-CRei7@|&ri19;4
zKjT;2ExoC@cuy5vnB{RSQ=Y2-M)4F;%$v0oMcYL2p=jF7aTLf8Z%p`&dUORqvtKQJ
zR#ClAuh}7k5bPu`P{mH<SJ5OlH;MeqI5SDWQhABjOJ*gkK^DsRiCHOvrtRV+u|7|e
zks|3y1-L2NE;ma>nrZk-1)IuTk;=&&CaM{t-p|QpaeQqTtEmh16!|Th9$0|kl!m!E
zF4|7RaxuWEJQuB<%yePBpPlP87~3wki!Iet<U2Xg7$fRf6jDpltd{Y+S3FVn3DI+E
z$hIIgvzS%_J!`4A)rwMYbXA@r=_=9q81?F+^;!bPs9#0I92J|S<20$9i;Ck*^Assr
z%3g_4v7FgLijwL0!e83cCr-g+wh<CmBELC^JS|zMAc3=2kJg}YdC@jN+jtD`weNo!
z;pP2@Myuhl({2X`#w)xc9ju58e;!EZL*Y-T2@`e~9(h=DSD|zkH`@rC(AFnFhhype
zYChr=dz_~9orxOS*F|_OUTFzaYc{Zi2IY;Ism#I3Si;CU;t4Y<DD7gfiC_(L<Ibia
zl#qW6`V0tZxGgB-6CwxCc45rnQBQFN1U=>T+WqQI#rZGH@^kRk`kLqof5R4pF;8Z}
ziGOW-v+$_a$=maPpny=$kkJu*2xue?f$+DqYhrZqM`bwB7uK0S^~N`}zWS9WH_G4N
zx=WNk(9PR(kTf820+;-OX%BKmJhvtf;?2?Vk>h}%3*=hoi}AbjKPack-%ox&J_Gi-
zbQg0Vjb+W?eZ6-tNmc$gkt&NDK5br1|6+xFLGZm5lfI#35HS$mx5;kB0KRNs^hhi|
zxivqs{79NJ{~NRcQ)O;gPMi<q9V2?!?Sk?L%4z`Y;cLiJTEe5<Kt}c=^@W}>x$NcL
z5;%t4G5Xx<FcF^pMo(OV&yCY-7!WQHN#CgCc%mGqd@mA5(#5$_Ik!|-J9#R?U76QL
zWV`~i68eu;=xezpQ}!!4T$RkvE%O!RJtCo>Q{1d4(<Gs<6DcW@|32jP9iyPQ9InLf
zBNV&I(pAbe4PQe=QF?X5a@`)Sq_r3LY8Vl<c|;}0L~_omM?3$aOTrXcwaIyxwNKK0
z+ad#;h~v^posl%y&+>Gl9WZ(Sz)70SW+S97F7G*a$zzNQ)QTBJ+oaxsLl^|)=VU^^
z<Ao{mDLe8~TCn7g?QxtLFK5miFIK@D^<g07Boax#wa4QXx;crIuJ7;b(?z=q(o&`r
z%>yR$+vw%uy|8XnO@Ot%^ynzq)#8@!MYNI|e2$H&?2dz%C(++`>Hpw`SxOU`P6}P>
z7w#qMj+0lw(@x3dPf_QDbZJj`-w;6zk>HUhMELDL3m4bZz)^tIR)_R)2Zm#?@$7sS
zHRM5l+<A9yu%VGEN!t?J^CC6GKKOA5_bNl$tQ1(vR;JpiAzE?tv5~98jPCDz6uLpw
zK#d&RbpH-<Sqt^m6Q-ZA@0y#QnE4R@ue9YM2c!Nh-e3F_-btT-cS8v8-3iS3>ctA*
ziwvRAdz4;9t{)QQ^GsAYi;4M2rC>WR9nu6o#12s6LZWb;2?RN)vB?9&Isz)wA-$A@
z9(~Mn#tr@^r|2cDgjm40rQ#@<%7?K0v4;}P5b8)xZJjbVEu@I?_c?k7Pd@dPy2&(>
zPRZQe4#Rl^H<q0r{IA=c&Fn*!<x^~9ymQM(Y_GzwAzP|qxg?75s6j(izK~{$8Zs%O
z{^t<V5>v#4=7Suq-_V^-r7m^b)HPnnKuLXM9k4IZP5Kph8@nycOTNmlz?Bzk-#d`7
z{p%#<eNr-RiLgHeN$5KgB()y?vif;}NlD3^Q{YO9^;aredD8l{dmSndi=2s#=+*fT
z4<~OPS=v#T9*x~L?I=e?b3HXGB_3K@rHY06;yPA7wQ6lO>JF5nIO3@P;4nu(S@&uw
zA<hE&QD_ZRI?{SNQfZS?W5bpdjm`TLjYc}*WXVVV{^4fiV`2buV}i4+JXE80BrpTx
zTO;!!uig3hWnv`wwZPL)8;O1?TT)?>N!uEvF&kGUIsvd7CNh)|pOuMOnV9LlR3>I+
zVisJf9C{Rd(4<`jYI+q^qdU=SjW?f`2$hOUjxd8_xmx^d<$Hn4rl~X#Y#O$ZCZ}t`
zWk=Y6iws?Di9f>zoGo<?1gnMB>6xg{X=!Hnp?Bukd@F^rQYi0Tp-hqgMRZHrtkNpE
zK@Kyjw8}zSQl(WE>!s2vE3LBNN<9*-GDKO}gx}DhsV<#aR~k{(PpgGqDplzNEDx_H
zrtYJaf><et*$N^H{%u4<B-Eo#xCi;kd(x<TKW7g9y$Fb8yx&j8KTowI!sreX{v+_W
zBi~=jJS6-ka{iBIBz2#a?(Z93VAzI31Pwku3$oItylyP7!1{;c0I%5e=nD}@(^L8g
z5D*tOnLu+w`HVRYdUl{5%?Q?I*!MTGJ*cavOnfskUJB;xrDxJvwISaEVo3n`EZNp$
z7D01QvM3XDv^VZ@K@Ic?zld!u&8@g*rLWGlH@$k*p;Ra+nliv+C25s3OVP4w{#OKC
zihvW{!JF_k7jtE6T;-!gFL~T#VizA3WFYu=?9bK1b1EMto&%G2wtF}W7I~r}<uKSF
zLl6j-h)9HD<SP^#PFehUgi+JA`i-_}5A3el9`(Cs-|o6*vo~=X_NdVuj5<_d$}=V<
zIzafH)Fh?hDF``uK#CY9P%ZL;_wK(|9-(W_AlIPod*|*H^!!hfhty|@J39o1<4(~L
zz$8cQe#NHFm@BbNh=(W<Aq`PE#@mK2q>oIGeg51=;zR%eLDG@@l*Q4Mjszu-@VT%X
z#%dAyOM7%yRC2z-E*eUeED_CYv#@u0fVGW^aKb{2jNMjuG;WQX=BVFs&33OpHV57Q
z$m~t*NpCQ2TI2Sh1R3j9Fdaop%GuMQ<rEFHBI`RNYcgN4^US^JG}w3_GLeT{1D>&F
zTda1cEvd1hkB(Tu$1J0EH<N&KoGY%WdZ+4+(q-%>`L}q#cnaG1;?0~xZ-(ztlh3=k
zJ&I*HF2{7E$EcNQQ8?su^q=th%DQ$Se<IHg#>=8}P(WM8l^qPnK~nB>IP~lR%C$f4
ze3*GaBa|{|<}^9|%)NZ^#oPNe;x^DN%BDqOZfhvoO_aFEJzGEYWkl%Q?xAyKC#?#5
z0(u9>O$LtQFE&s~`JkPudKm9X{hkFryd40~{Yy6l;7`cg;derdnM82E%<a;f`#-#Y
z9bVUulT3N*D_{?h4>3B0H$)w<|G|6U53sT3SOk6+4}X1<F8gN#2>iuzNY4xax!Zv&
z;Zt5gMxw;%BRzF$sTG;UN2<2dtD>z(>b27Aq2WgAHKlr%ad04<@Hl?Mn?xErz8lPT
zmUyky_{y+nH|PjN2O)WRj|nS|6mfVWL`&uc4)!-&uCEre`yD>+P%2<=nk#oJM8g{&
zckt+~fflP$j~~fZI*Bj4UZU0F!>Gx~(nWkCgW(mRHTI&pY9V?@1CVz_OcEU_N9Idz
zT_`1=MR(tVDg>U@lCNFR)qOlUGV2^#Nl~@$DZwB)Geh=)t{e1ENyt&0v+JcX$jJq{
zvpiJW{lPI`B`M|Zrb<$}pBr3odr_hH^w4v?cX~SeidhYpc>5QqtS2CYJp`)nof{Zy
zUmt_M>N9eM%%@z({Azc8eGEtJG#fR_Wij$aGBvFy`VNo$<*<sCU7Z`0+zJr|o65YY
zt}-ijl^OkJhymXJg=Ps(gbzu#n#D(~zuQbZpnJO9EMJ;AAw!z^qH+TPHuF#HrTqqG
zZeP+S)O8G2RXAXte?cEMC!t7;Yz3|hG_$n5X+Yyyn^E$A4u$+)Hd8&xmFckPb!hq<
zJy>M1NZOaqWGj&Ul|}zqn^|+C_j_#F1=?jd&b(J=ueZ(SenAJwFZS5N-uB$lT^7q_
z@unmnZ{iV#pEEIdbN6sZD7WYy&XkeUvotxjegg4R*pVZTER@)kD+f*Gph@p#s~t2C
z@8lg<r^sR}l|xyE4|$)2(I2?Fcf~q;Q`&&KTtWwv4?sPP`n5^V$v;S9D(<BbKS!u=
ziP)beuqZ26MM9OS9vB|2)P^t%J9~=yb4UwxSEA}dsz!Whn^th63!vQaOr1yh?sZm{
zNgK1xxWie-aV~$A-Zk}pJ8x{(>a;(Z^17BgsnT34%{9H3N^`9=*McjRt+~SAm?rh&
zhM^QsivHcD+FR7&0kz(-$H$xW;BD!K5ARma+`6{Jtz1HZ-V!I~rc}5m@1uMqw_8;T
z-lyu4tKv#arQ{XsrBd=LC9mL0Wh;3J?#W=CljeyhwrlaaA-3W-BxtIWMKny~t#8Ed
zttxQEm3%X6!aY~_u6X9zSnuar8#yVE;4=;~rs3t7?B`lS;-Rc2Kk)T7vKlR}wgCmx
z;HP;Em)Zw*n3ws@TV6#UvE><Ek@ZCm1=4NYm;1b|dY;$$9y{4al$U$RL|`zg$M}l5
zc5}Q=L)A}8yz&1c1u{#aU6V}$+E~7lA;0p!U21%FFH6csscBL0au)S{_9)>zQL#t_
zRV5Z5u~;NHEiD#FYbKw5cEMOgDhRwiQMtg`t`ZH8STt}1m6i^#>}xRJD)CTQJcNjQ
z?DC=F`^UuhQ8X6kdu&;8dv0!L=z0u19yvP0c}vj(Dmm~}<UokF;xd4?B^iU2D99}e
zqF8$j5}}Y)z<IBd2ai%7a8wnS2DByS+gGw6uPl&p_T(f%j9V&^@F+z>Y>HVjpb`KD
z1;Eqh{*a9-0r1ELK!}iJ89?e(uD}99AjH^{mjaY)Dmm~Z<bZs)a1l#^wyOk0(Hx5x
z#j*_3^99SLCFV<r5DWa|<e9|Ml@NQBLQI-ZamfXZ#fU2Tm0Q74(DwACf<%**Sa_Ub
zL26$@E>NF7ZC(k6{DMKj+Y^-xj1Vi)@Q6i2q(uqYK-*V-k>Y00&zxEwC!WVHB4aPq
zR5wWJZv@}eCXsqYRJko;qnAa+H-SfeTU1f;9z2C>1FCzW;^&^LD+8)41MY>A$JLbq
zv6WJ;46quFga-hGrp2ZA{hUn~z16hfVoH`CcJjIO2z;h3-u;>M&FG`B5nXRiBNb|t
z!QdWWp;TJb_}`!u*h`mw1tsbn2yGR_RfDij+AB2b<)0DIsAj>p=r|NWQ3!lE{4P({
zl;BTNO+p<+;Er%cel6s|^oa-$hNHh9E|mJaBR*7m;GC%PiMYGr|NDRc&;K>{_xG7b
zNZz#h=8lZHeMw$~n7H_!s6(H$!8b)0?iip<@okCelq#<-;e7ytoyKo&uzG3eO}rIE
zqMrN+?kYnd;soE=zHiBtjPVP+@q*Y>mj+wr01!NPXAU5kzACi8&k4b#HBDY~f1kY1
zK`Xq7S1?cLQbE0`f9Z`4dp-|9qIvi#>;fMrnos?k@b(SYc*7aZIETS{Gj|FW(sYH(
zRR8nAXz>>+FwUkfK07-my{!Nexw%8?V}dU=k->d&-MQf{4UkZPAqSt^pkfW^X%(=R
zQ4APt*dV`xtC4RnoVx7h5>K;xM9tJuSvxPq{~{#2x(a&0o!o$b0paNaCSaN<7-Eae
z=eP>MTA^4#IfkT0Cu<rP@<)SQjRHM6fJ6?IJUaCi;2>_<a_|dO=-Vy4nzsm_qGI6L
zLspc;xR^8uoeRP`UyXwC!XwI|aeA`9ueKI~Toj<NXF!!X1Jt=aLq9^m-_W|@gJyLE
zl>hWsK$X*}F~VoHrY?U^3jwnxk{rUX6eb`?1$9cwiD%rnrVn`;Q|}87@B-SA%?Bje
za<!O2>zNO~2cZAqaADF)XKVrh5Q;$K{t|NOZ!a&5<9Bago&IK=zCAzv?e`1g<mJWD
z>FaakKX3L0=Wyv#j3-b$URkuf!h_p-v`~^jytv=p@oMQx5+bJn;E$EzC5I@+W=;g@
zV;d%R<-)`WQi%e<Q9Pg8H-r{pBIp2GdXt;9+0fPk{IQI$1>0jr#O=U)m;!W=(FDuJ
z3Obk?H!!Gltg#Lx`6T_izmF0e5bzwDk=L>Vrqcy;ckE37DW14S$+)&}fC84rmHkx=
z2E`0oPRIfwvw1TiI%+7$pfQS6+xhARltW>LRLtSXUla5n0s0wAaiu4#1yZKMnTnKK
z&4IF~dU4c>ilaf=Mg|(N*hM3%u-I++u0;&JPtSV2erwzuwN1P0cFneB^~^!j9h>&R
z?scq5!)kXsbjQupix|2rQckJ)7e2YE$Q!Ci(#hd2?FH}Mf2}-XHb$ILq;aU~soHlC
z?-QX$eMPd?`HGurKZ+=y;x;(+oe49N#v$;tq!Lrm&Wgf&gN^&$HX4eJ+gem3#!V(g
zBj!by3wwTbun5&%LK$o=+qTsi^*epDI~d_w4*I4&nmA_Ho^&QwzvuL=R++VAN&?3`
z**q*|O`}`OnoF7*D~m33%~;68iW+p$s%Xva?)-?7=IxFM8wf*;b}E}-u$Fk&9PEMU
z&j+i2I9pwh+{LaMb5KU3r@^ftoSLjeN9kzNYq%Y!;hIf%GBMkuv2708{ed}X*rRT{
z)$8~By%Ka3H3u1Wv=gX9gEg}CqgW>XATGxuNNO<@sow_)->rT^L93h8qTNm?X}6jQ
zCE?P=p!J$bBWQL8N$|Rjc2X;=*%%}Zy$KQ_38d()L5xcq{dvbEa41tKCz!NeWubs8
zZm=aMaKjC64(d%1^9z(E=E$}gZgpsi!oOpGeiPk8OL~#;ig5>I)6J03A&3IUhK(M7
zkG^C491C1z=$bL7K3g8vIdz7Y&x0jC#kgmD{LJnsU(IkY^n%Ii-~YY=xX1;xMCz|b
zzi^FYNEM|a*Sv?vuj2wV^_gYO&=iSByI?(VjgLCTk~Lx3H<sbNiVQ2=Pen_^Fd!c_
zXb=RHW-_7;*Cj;=n7Y`9-o*V5>O-)LLuR`@))@x)p++b2>De9!gn#JOQ!GgWtV3cH
zzN`}#2nWWj*;*lwTuNNfB{9KQo;!6y_e>n|1PrY!Iui9G(`E|Uy~P_#L<tiX7NN;u
zmR?O8WkK8T0=Uhkk%FVewG^ho!qb2)%ZsV)xZ%8QUNf@y&ux~jaUd%(!GWs22q{Pu
z4lLJdYqtl$RA0fITLcHf{Zl9Q3c=h2<b80EVPGDB)VjPx5ZCr>Wls+ltJz=exo0xz
zdDv`NUDIlq4XPcEe22=-AC$fgA~&e5J!A_v1f2suKBs<mg=8cz`z?WZwOr2MxXUY_
zDk^91&M(M!)YTYHNWm{GOCTVY?%YQ~@4=>aV_f?V+OuNs0CQ~i%P$7=b)m0nY_F&l
zI72_yc)D^xic${&HxRjlff(6dU`XAg<_T?AFvf-O`HX!K$7q5-yG@K6B|Zd_#CGzV
zAXdg>A_ZWGZIrr9U<ZA;t<z@X6$Bx+&YCfCT_+d@ce0fZ8No|CDm5rH0}?T!WZKQW
zA8WuX`!Pt_z;*t605gOg5C0gVH*%L@LzpAiUri9pcBIATw`3!6e~s*=VjF(Hf|VC_
z!jaV%P=Mb<h@`5>#!{-%tR7w!^L(^bCn5oeS3O=WVAe}HeM_o8rlmZAOAN&wlMoB~
zWc3XfVGXr04X&vTsC#JL{hn=6#LL8sPM#ZaO5B`Y@PPZbDl=~j$Cq>pNqV47Cl8zV
z7u)J5#I~$^4{nunI;IC{Wle_VeI<D*?e?hc4tgDPV)w>oyKA@1QMWrV`<;eukH`JK
z)oPdUNc`?jsgEW!S$|u3jw?GTETrX}9tyo*2L&`pO`E{~$W<Z3_<=hFU2OP;YC!+#
zQp<q+K}V%8<AD%T%si5*kl*@=fN9Y!ZT~sy3v#<4)CRU?+Wi(_zSnJ<gI3=$JEKW|
zGHE&RfBh1em)Bm#b~gdp*ML)xMx#DS5(g-ofZJhO;1mS}lW8?Y0}1!wm=jUm<p}CP
zVuNlmwwJ_)Q`B&Z%P5q+nn4hY4fD97ZHJ2w&KaRW@sX|H^XE2(1&HrNPhFdEpVUI3
zqjnsjg;ulKah-<QZGw{DZU9w`n)qkeZ8s;tnwHZoK?@>TLnegI-4Q}K@rZ7R9UF)L
z+t|swPl-p~gyWd#Q+DV!4oU8u$1M-Z!(~%1SnhhD_gM{~nxpA7{=LzVlsTr$VMQ`C
zEKefZrB7AjU8pUQr1Cik2jopAyJCD}mVt+T)rjs4sy5QvUO9>W1jyd%jGAMsZ<)Q;
zpl7yQW6K;g8n)T&yH>AbyM4PmDM9vy+~G-{S2-$B&ShT8IURbS<KAK(9xI@5-krxd
zOVf;~S7L~aUE@#g)RHnm{v3S0Bxx8g{O^ajIW&xhVGZE_@eku0p1vX9n+@_|jAtXr
zhspP)=>}sP*6zx7{BNXq;ZI#s8c9sWl8HZF1-PQLF|q^s{{4D717rB>CHanilII5p
z-@bjTe{0qK#pMBd_Ya_0s{9?jQVG?q!C-JeDv$;s#BB4*a~yX@8c>`1)3d+)`SLG+
zMpu<Ffz=^JzgVL|%N>zs4*BxN>el;BqhIg$yW@t@t^+G|>b(wr>h#)Xuij{MjX}L_
zS$4hM>)}6q7SuB9oo35u9QW&uR@bn4^-i~AH0xI1uv+yV{f$8VqgA(B9cbLK@E>Vh
zZ#PW<IXLdsn^3iDHH~iF>a^?KW(PX!;Qt2AddsltgMJUn`cSJeAVV17KMDm#fKdKT
zXM2EiRcE|fOm}~2G@9*pv(>XeBn%qOUaQmHQ*dAnaK?iH!9i=#1SGUtEu&W-w0mZ^
z-tM;uLSP;(Yk>b46524$#@MuA^k%)+YSOx98>Zi4zms-=1yIjy{1yMv@wcoNK_fu}
zK@&{1*#Q*RTb&+ao&E->Xu@y(KBB4FYt!EmrSSg@p%$)DUxNxZ$3eXbgN9l4`Z$Lc
z{$p6|HjT!#-iJ|H^<J-u#clkD#f^Hi1=#5|r?3<q7-zp7DTj&o+VxJWGc|D#T^um!
zpo#wo1QS*cM%|wRMseta_8>X}z+wl{jUd2`s1KAOnDyoWhe(Q9snXhn=C6BXnFe)D
z|0WLLH8ck5?bofg6`zDjW<h3Y#->ToU?Lv=t%!*001a+?I{9t_2b<%D6<LA<;6Y^V
zzx>zPD475HXOL|(gUC%PBS2t*-E{3uZ=M_P=I+cmw`akx2KoNYMVa{A=r$Yd3;H9T
z8&-S%{a5-o0(x$Y{HgOReZBX&X_1F}!+*cd{ebN0&y9sU1!48o{dMWjpPMZxo4S+b
za}(i_QFB-864V_7_Xtd$fdPF3v1=Q!?~T8J-n97Y-qfgu19O83{pI7f&x<CCp(<H7
z*qA@>qGSy~v|_*@sQZ(NH+Jh_{U0n2W`mLI-t;^6*`Bfwos;S3-Fkj8KGO3|#wip}
zr`{zV+6%jO{BckZcSP*m{`YF(9t12>aIl(TTwn<rrnw}LOizLYVvIiU1{=`qpWgDy
zo54bz^H<(Z<-{q_QOU6Y<BdJDFI~(_Hg?ZXU%uHh0+wM)v-098s3hIaxCSkixXb<7
z^akDW<bl6y%p5zuIK|{XIzlO(t7gC^=o?>V{x=vwV1)1GkyfCqg7)D7#rX^4)ISdD
z?5v@j5k~T4!9=HNdE&)7!yg4Mtc3#=mfpl3F9V=W%&QHI5AR<?*RTn=_zd)w3x8k-
zXNFDB7-9w*Cfw3-u~7pA?<-=BLz!QB!4>gmkNoA#T~a95_Vk;LbVM=%IReDY!?i(#
z01`1x5tJ~@NW&iBcWvd7JGL>x0rmriMKI}dKA(Ctkxe|?2k3HEW0qNJuRy7ziwny>
z#rT#1$_h=@bjVr8FucM#4Jb#$L@w<aJHtnS0c6s^zC;UyB>P?0F=0<f4L2-Jk){u;
z3kE%0xzjlx0wByAd;Tg2F)Wr2#tpC*hCBP}E&LgwNj4e`h!Kki6YXRic(bo~(DgFf
z8O;&I*bzDZ37wBURQQ3UKK=oqeB;Eu_CwBtZkMb2$USJkaF<R0k9Q~jH{>SD?y(2l
z2h_qU;#Cw5teg(T|BUIp|Kyp+@4$MYha2*Vo&WfFdW|tK97{N5B3Tq^16$J-AbjdB
zXtBu!&tIup+-)@e>lKmLhb^nKXXw$>Y&-;dG^z5h{Yzg#QVdJ7CHNX+zp@1wnlxaV
zQHur@ZN=qj^~c>o!|9p5@yIdTU9dVw-CobMCcS2N&~)03G4o&pgNG;NE{<LZh*CIu
z9$H_l@U^hHB!PJfhF2hba=~gOfso%Jtr5%Qf**@Jg0)>57?}x_84?R3nq1cJJL3sx
zy!K?!hk5ne=D=}VrscYwNxMJk_9x?w&+FW^7vn3<q~0+pp&xcMAbJ6-Wk?gcH|KlF
zkSpEhWThZ{aF=LS2M0XCA2ttJx=wg@KOGjYe2nlg7(R2qu|$_xk~s0A!Dc0()eJn|
z&u<EVU9)Dqf=!d`bMG)QT8VIqF<uaVoZ)$sUFo))mjGvaPR#w&IXlk3hp?nN>|Oxr
zu7cCEggS`@tc#@LW6xQT!>D`IqmH-PBl?94UiX8JHVM>+#gw%MtQ2ofF!3I?pt%S5
zSI0^5gdxcV#}e&}6cq0b*X(!Da|lN=Q1~qeBo!2;1r*ZyK@-f=N~|OLM~<$r3L~md
z&-U;qr1UTZ4^+lZCtXpsj~(?`5OmSgC*%T}m>ZX52EUs~l0~__RH9u_>Aaa5=eMpB
z(v2fPF`vZX_1LIJD8XP*#us3%L(ta8UqHE`a;rcHSr+!!XjT#p3AkA7Z}L1yu$~|c
z!~WD!ncuB<Z^7b%he1`<qN8|bH=FsgaWQ-!luViM{3d`oWf5{3f!;NJp0TX9pO!{j
zTS%ikq81?;<Ie_I!n=DaJYwj}mK|E)<YX2e(Q?1fNgzZ>ed1!kj|APg;v{77mjb}i
z*at2^@ky*jHwyiTe8aS^Fmp_SC_EM7XtYNZXA(b~-=O|u&%%D=+?SdKCQ#1<)0OH~
zsa}=pRY3LHh>EqEmEFUb1d)1+=~O@4Hr1)Nsh?q+x(`m5RnzTebUM<Xjn#V<t5>YP
z8CDlLYsZ+m?I0DLkNrjXE=EDVkK8Q0Hlv4wGRUZYHb%D^8{u?38AP?rf8e)63_`*3
z|6q%kDG16_vF<YUP(hAEmv^3{#lpTh#GK7x;4XLNB6_2@02GI#qwpB)*v$g58Z`=N
zSTkPYRkKJNhoQ>;l3qV6&d;&aQHX7@eq>btcnCzJ1-2fB0m8kb7Wz!VD>u|09Jx`8
zaXmCgVBI^ydG9G$KRtVJeCPIPthW@R8*%kD2Ym1Aa(b4sBE*-#Tptg<HX3itdaDoz
zc<<Pk5uCLSZ|GU&Em?=v2xq#H6`-IV2KNl9DY!p}Zl^BePoXwO7XbBpN%ILm{x5?b
zV&)rlyd<*K#EY3sj2FaMGogx1HF6bp3>pzMoVv5i<<;)ecWyv8^u`)2?;Rdma`SMN
z;J00h;FwWQn#!%1dzw^t7l)P+NB0{%7BsIAzV{z@f$%uKkEy*y?V=FfFK#H@INCFX
z&8JVx^72N;RkAIfXiTfPl0=A%C%LjtZg7ziMVDR@aQX8;eQ!qHP?Obk>aPIbiNs8A
zsw8V7EL%F~*lLF7xYDTQW8<>`Buwc9$`Di$_)~9bFK&ipD2ITxp*-yf&4ID)I<%Oa
zioD(pt6O?HtSKERy)XTxJq;ns9sIZSmcVRabPmB>Mh^+5F5*pYtC<4~1++Qcjkex9
zV4tNP_x7zuqh?rp3TUxJbT;y7yA1U20Ny|$zs2dmn*p_FF&L7<pD+Wx9_#zi_|pR2
z0QETON~;{lhUUs~wmOGOA2s6xX*~m(btV8D#z58#b@<%9Gvqu^{#(==6ZVdNElu(}
z8+Y&&JTkRXcNtLxkiN=45#fz}^(ltL7a}s=Q}}~lo1Xj83zc+Yb7||RGPhxWVyA&e
zBzu%zxf6evA-A8anKvi;9<EmJmb!g{XV2!$gO;%#8HB{iQmXL%X2X`dibCLoLu2X4
z1KS<<I@ZW+^f1l3HL}fqV>B=)J<IC%d(PNxcPMu9^b$uD`7B+1OA?W#7!gQ)`BA5k
z!sN?2YY{2-DSiyN*Xwl~;X&Y>5--;Q+ckw<9!6sl9K;~S&Y84U`4}%>Ka7P28*y77
z9Dr7DgooKNGu)*&KEqCmAtHLBh{`pl?@@&x&jnG09vT-&>O*8yV?V0XsW%Dk9ODt6
zg-E^GsTn&vdwBSW<X-#`G$q|U1%ru!iR9*#1%l?#J5V#c8JJ9^f&Am-ZP~V`Gr+rz
zTjJTm2TBXhe?Mw=x~0Lbi`CP!BYy5{Z4hMvAQhEu``*0<*<79=X!|vYL8Md37IQi<
zBN-a?&%FUiC;``oMh&sj$XNp|=Zi6=&9VSag5`Pu6jyUuFp)SySs=m#z9xW;$Ut2_
z<a)4Vr*c_HVc@YWgrlPqGMv)w$Hc~4v-w&xpddcXXX`>ZE4@L{-MVyZactRnIRnf0
zrYs<d((!$-(~}JWT4#AqyZ|2=SqB6m&|zsNd9|8OZ~lQ#j7~h)VWEU|rxjC4@{(c7
z&VxJH$p8NC+ss|8L5!q**~WMq5vCF?GAEL`gOYUh^2AJ`tVhQojCIy}LnK2_q9T;_
zA*?fwHC7h8F3*T$EuGTrL7NZP>wOqxjXz}st93D-t9=Fv5J1)((x-5?@MfTY+tc+x
zeYitVWdY$<ieZ(q?YZK*PWv-^S-L&jOv*Mtrgx9O_GYCq_}2Z#2C>dMoY{D}azQ`|
zQ8~$L!t3d7wYF)+ozI711AOKEwSO7V2n!U+0SV~NUo5eQXr*$mwTlS_M&zD>nU7;*
z5#LYLFDmB*i>ph%(c5;GS1!8*h5F!&hBb7LIfz3jNv}7E3Qs2}5>mwW1V(_$ip51j
zvV6FRNW1c&uI)XjJg6#w%7a>YP?OrPftJdHsu@f9QB)q(YzUPHwep~50$OKzDi3Pz
zou~4k#-Xf7$CU?Fr=XNy*~){u9_Dkk&p^R?zRJpjn%chdpgyPv6%SIGKntFWFHuq-
zszbd}hYd_5kKT$v?oaq3Jc!SOrM+0*V*0A|5%la^19r5zVL8MhdlTNe!w%cSVC{0J
z?Zq@gzp3GW1(4YPgLqIYALtYEfi7I<1vw$H0Y~VjUl(6`l;UxL@U%qcu_^iFQ_Afo
z(L+lD#;H?dT_CyEjFa#oTYh+>CS9$CXQ`A2LZ#yH!8FC;QPZ4Uj`$C1c<`<kJ!)Pv
zbl!oQ=J;(*x@=*u7CBKQomjK+j%sQN!a(`+1@z`>9ggPV<Eo?;NKXV#z>-#{j)6~i
z!EZXe$RPRqT_GU3l${}R`Owr`_gI@cKfO#2q((l~LU8e)Byhj`!IEN(En2LEUI16e
z|44nF%mRKvT$yg^&3p2nrNHpJ@S-0wL5b=}?)>Fmn;MyPo+>g3BCzOhq&yt>+1vBg
zWa53_tI@qSa_JrRr#S;n*LY7$Z?sIIFp0qA8xKIGLpzX^1rjy$0zJ>uvLq&^rEgc)
zBX<Ep0XO5C%mi#iQQ8fk8Ro@VT_<)Wy-&wFl4eY2ijR+6C<0PqYq@LnI9*h(io<i9
z>BN~iA<Q)BCjBRmB%vg2RLVk%VMV1(I696RHn=<k<4PH&#ZXp@^PxME*0_V$S4i@l
z^2ffcOorij(fgr8waVzi?lIaG#gR!xkMTw~Au7O;tR+bv*_*^*Sg>9Uh4)!5Uavbz
zNa0mV=UPf<xVrbKbRHf?D~4}LydY2QBx$3}+#`p@aitdiG(kJ9<?r$hf1n0$ElTK^
zdOxSbqcPfd8|f2Y5lZUr<#*UM=wIvhbaq8wF-q<VRqTabq_+&4;S6s@SmM2n#Y~6u
zEjt(+tkPCHVG=^#t!@5jPu_+iuOMiD!44KCm{l?Rsk0HoDbq;GVIb)f$Y_(D&wA}X
z)Nmq|C6h?CueeEdVPC>tb+NGVLAckr7-tKA>BCCAcE955S2`<)n@1FsVl0IwkYsIb
zWCsj!xvl$Gd`DXN-(KT8$;jDwDmEWAcJm%LeJba?!>q)lQ{GaI;-is>BmbCs%3#Rh
zaCWUMkt#rS7hq0Jf#L9Jb(EnleHy~Vw+Kg5|2wGK;#X8(@W?so=1;-+%DuKpEB<8J
zC1`7_5qYUhy!Lf)gb(A53EcryN_Hj(6&wKM(ZRKiA-w|%lF%d;)+v?Tf`photNoY%
zM>RvaOndg+cm|?OTP0wzKCJWcD<F-i^1C~N?zxV3>g?=&)`EbsyO;jr20?KAJX7o4
zMnBvtfPSd;31=WgfvEbskUdZ1?0LW**;@n$KnOOb^TkK|%$|FHgh**NnoYA|;s3*K
zi5CfJnjm=)>;OTcy&fL#m$0<6SKA5Kv>sZ?Y@9na)_RApthrM&rm(EL0WAM=S3y12
zICYu?><$|H8q`0783RhtM*!oCVGt@fp&f%W_}dQ-`tR<|AtzftpkIxtf9a#FN3J^b
zSn&|Q)`PE?zZw#_!;337PWbpnq|Jm8UNFq$KR(y!`%?qi61Wm%rxAGH@zUhrxpDsP
z*x+cY(Ti>`r4Qu!1%P$(_Poaa^ZW4`SZ?@)AZ!`0{Y%*ERv;;e7OmM;>IRsvODZVA
zdM0_EB=B%d-u`5-h`u7~hOvA6^3@(9f;`2@NXj4&mf8ykwl}J*lbN_zE)4UlYw*p2
zz8*89TVnXaBe}Gg({6ynd1-^phUwEMwyBpOn7d;SwrCQ}2;ct1U<BSeEuaDEEnrKn
z8KV$0AoNMpKOiXL4^w*hP$*&xudVi}gn=(eY506)z%YoDt<e`aab6?lDkb+g6THHX
z;x8Qb#^~}Y_Sh%Rh`b)ksmlPhhIlGm)HyIs&;UexAmwrC*@Kw$_G#lfe7zMq)Zz|M
zN0dSA>Q}OUxOWF9?i`gC&`;gqkXr8bcO=mN@iVOk#58ls+v@3c8Sj%vCIij@ntDu}
z9)c|W)gYS8VT=W!fbAIX*)zTvP89WqydII=zrr$)D4>@dRj_lvp~xbWr?1;`Ju7?*
z7t78<#L&e#j*um1qF*^3FT^lz>#}Ij3H3P%0P6PzA)FHS1FFcx+YWi-V_qW>270cr
zIY(F4_NE&m6ZDCF(0xrWI;A0;`}8$o9SmuE;HXWgmbA|f0|uV%ukp6(PD!BItL2ry
zNE~`>OgX^@t2ye>`Qhs43X%uMhDzBIteAva_`D_7;>r>0yv{csq9)}Xxg#-n;_$h#
zjJ+PcJxLfBumx=Ho(;7=>MCfI75)<?eY(GJj)jd%-yvzpiS2|*H_g29M>lu;$vL9a
zv*9^vD??ns;qmJS9}wHc$&re!859PkwrfNwUWW%CTO_=>HKXBfs|Ozt7nN)?-nQ`^
z1%bN^wrx}>IniaYZQ}~P727s4da>KqjA}^jxFJ_Tw?T*|jBR*AeP`P=#N(;Ia!zCm
z=IC1E%@9E3(TOH^J47(s`Qk=;9Ui?odMqP7JAEW0eeGV_<C{$lR`>aH{9~-1>cW%%
zl-kS405fv@1?<<qr`S@w&L4VfP8dk6T(RbO>$luXr)x?QSoQ5PEi$<cTeWlIhLy(K
zsyCwU)pcxO-j?G`X97QS!c#e<2h}Nw4VvamGj9g{Y~eeraoPaYim`EeYqTw3y7N|y
z-Z*&)-de{~%*M%`{L%&*_Y}9xMqBGC4n4%uOt|m!{c7q`50bUBSC_x?PS5A=7}wE~
zF!YT3>$HnYreX3b5!5n6ICzIGCG+*!N0R%8(+M5=yNmGGoxIrFA*otA5BOfq*hz7L
zbDE%hhj5aZPFnQO;mne}-Kv+HOH(rxrzY(2Bot<X%%@@b;gN7o<6;Dc2v!>SH*<Ef
zCE}hx0~y_l5Hf~B`AR-h91lDOgrgE(4)UcQx;^XmzgG*FI6G)raL{a614?WMu$)u>
z=31gr;yC;zx)*S!P7tBlw8$D-pB1>_O5@z3+uSqJgQkpAR`4w5MadKDi4hO6E@iIK
z=(+{?a43HkvRa)!0jiS&&Gd+o@EpQ=I?#cmsZ*B01%RT#AK|H%0xlS;p&?>#MuQ%7
z)g0riXB+Qdo?jTiFm>aY<fxNp7U-0`*=5auHJ<x33}2u#`q~F7Hb@*`fege15r#Hw
zn%s$xp$2%q0>AtnK^m`CvoQ%a!0*JrZ3p=3B^}ck59K<>$Nhc9*xBFzysHVR9w8&q
z|C;A6jYCGlr(F984miMrGcvI71M8uFV_#4A>N<@}-FgLH%?M_>#DUL%LY7~sg-3%W
zNH7z78o0VDBx^wKjP+9J-K3}`dy)_`CSAQE@ub<9^m%4!J*BkfnY-|OC#_oGg75@Z
zCJgR6-s)OkZ8gV)CFHXccHKCEdSU&ZRsUr+0+$Q#^3q+rlN`Xmk!S7~7gx3(5v<7t
z&$@y(4edad_Hu<h`0VH_*pWCCEj&aiUNjR?(KX_c{v=oqDClX+oR&k1jq^-I(vk*2
zYN-w^eMOD^ptUqUYf+7{z;WU*o}FHUJk<59hvts2$g3U6057ceps&XZly$nDynVSO
zsr!vRpJPH$(Z!^#FWBzK_dN1oLE@rK@M^8B4)G_^_9Rq<X?Usx6QUuhbJCW$Rq-S~
z;Uc=F{<Z>JAgPVk-b|txZO{4e$8u2b6LZure>}B=6xUk}XQXu^wi4kK9o89D5K`O*
zv5_6~OrDLbWnLaa*Cio(SQwsLr`KtqwtacIa4*UJzzt-g8^T5ehRtfK6BF8qAw74;
zoPUYkeVC1Cn#J$lk_h>?{_+L=LJkEc2$2`jMmbu<nNU$=hr)l!9havk36X6Bg-N*U
zp1~GPe%Duh<t>8cx$BbsHvA(&I^qjed|K4$oHna-*rRO+7W9OgN6H6%qt|vg9`Sp^
z*j?8-=V5&LFMahhROACx_W5{}FA1{{TRi(MCy9{*LyW@S!Fnu!+mZ<zEAwSLRs=K+
zW{E}B50iB#w0@e>M5Q!4E`n-3(dd8tphDu6eeF$eZg1-bVw&Y(67GU={@~cZy-n>h
zREWba6Vzf;^h~7Y?XCEmi!10WCwe`G7V6Irl}0^&$3))~alz;0O+HOe>ZdAkktHq)
z2MOBD$=Qq9&IT~FH<{HaC{6L;SUQ?b%xlUu?1K4D>-rvy(3KEDzP4t9M>Tt13BDf&
zwn~yx+dYmXsVp%j|5*iZat3e8Gqf7iN#y5ExtB8IJo)D$Kqym+$A8v`xdAE0p*{9^
zQ8Oc6)U4t~-krybj!%xOcu|}dd3^R~h!-^zMZ7wF0`%vN7l{_YG}{w1g24<W_xK&g
zj+CA@8bboun~otV!>wXTRV-<pEVP{Aq}ZVdV>f{y_X>rYw4>V8%u{k2A9&jFk5z;%
z{HY>rv7cg$;#Lth`cp;N?kd9e@S!p_x|1NaibcK(My4|3j5%?>ogpV;5X3`HKYp+q
z&Z_uQ_@^?GJl1b+_tn#kFR9K6FwE~GzSPvJ=K14GnqjXUUn=ISFzzJ2l+#zlz*g}k
zwOtio($x7`<4buN`VQkude>8l_)^kb!c#)U<4Z+hZa|80XpbwtM7^nD?2P_hok6<W
zn3Ce#G0?4KP`~k$iWupsD<QMwo}xr~xL`;>sH87oXtZLh0a(*iEzI?S4d&6gYcKFx
zG7Z48>?Z(ZD!T54eTmTbwVIi-Q822VkZZfO)U8)urON>YY78D?VZ5MiIbm_0qp4>H
zDNLnpETSDT$7^^+>xqkZ&-?+Rid{f1dieB=gr{f)ww2Htgn@-)I8u-J1c=pndO|CM
z0ssBo%oVpff=!P%ypbg{$x9?S81^W`k$9Z=C6|&x_{@c_v<6-L`svx81mx4~;2?6N
z-lv)DMF4n9-<vIWq58reFL%Q!Q;&vR`Ea+s|JOa}pk`P#?eIX_ewrzcip(yQ`Z;@v
z`Fx<Ccn`eP$pN*7m)7y?a?_xNwTeI`grEg0l@|fX{TC@Psb{4KP}*WcAgTK-0*nT<
z@-+{AWNE7r*2)K!T_uwS5+5&P)$+lV9A0T~rE2-$D(yi+Fxo`W<P+X3%Lxp<QV!k)
zH9Q~t3pa)F)CM_5BMX&Sb7O1=?yi0qhleecOTWWt$zWB<3_nQ?o7j+sb&EE&u<2|6
zTd{U1rSZOI#8XnsPtV>S9D$q<d4^n@ofGGzZYgxrmNKTLesd!^(k3^4BdzkGHiDD_
zSe53jx||>V<k3}47CHwOQZ=A6SzmsZ;hk&hikEir*eTbaGj0kcb;+IDWN^9)x;T~k
zsd9reH#pUZll|WbCQQbmiUgBfl;<##NUpBhG#+ovHaj9N@-pUs)O1RA2Goq51e>Ao
z)wOy9_c-V2jT9><!68-1pk|;lT<JOe#yLIil`CDXRk_l)$(3G+VO8&WoL|@ThUlH;
zOyV!?FYay<UTU2N>>RKg?93NC<QHQ_Qm@YG3w8`fVsp}z4wg1AfFj!6j)h3yQTG+@
zoqybuC@Fn8gw2Hj5}biK9FXhyIZOK(lO5q&pW?dQQ`Co8%6C}#3}=<kFw;j<`3x(c
zVdXQ->BOphhLz7SSCc|mt$c=YpJ5JPVS<lP>l;+e<vhN?1RtPey$aiPb82&%Pp^P4
zue=_-&Cb8%Je*t*izUF!x6Y}zDc?Y{6R)iKD1*>D?J~S@8IG&s&bf#$N$-qHbHYWM
zCpg`*#+>S8E9_hoV&^Vo&G=rj^qPrTdezMjoQ5}(rN=t{DYEmLsyuq2I~?**zvQ*b
zchy3bohNzJ*sQdz3wzW=%S6vwT6anJR}YV0hpsifB|8kbn~fQ>5zkf3#dAo{X%4-K
z``rtcupS;Oa)y`a2;NCHn&WMgh9m$*yi(Mxive+CUNR0K>cNP2KM`e8m(*htuT0%0
zQbm4wW4!9MA1vRKXTpz`!=-4Tdf8Ivqg0ls^fEjgnFM3Dx~8?{c4x@T<Sx$mkmsUo
zI1&R68{p-gX^pU4nyI*jRD(udB=r-yv^1rO(u=rDRl8V=rRzk{FZ=jn4d{1ib)ybG
zO#|wMi?v|Rx!m>jjIk7DQUiX^tY#rt$ptX3)By2yd}YrrT_@hg2@8iyL$qN|H(IiY
zHyhIesTc01i&b5PK0IDM#kF8C--4Ls;iqTE?@upIkB?rXn<m}6Ah-Jc^ta!OwRrRL
z<n+TE+9ur}!CM*F?De~UV!bqHM5O-d+gI;MgQA{@|Aj9M<F0Mm-|QQZ%lpIqDyON+
zX)5E^Xv$8A)PuZbbDE+(Jl>op24$^Wre@szk#SNuMK{dh4#_k>7^o_jNo`l<GHL4k
ze7Q`S47-tBCXF$-{W(lJ)I7Qzrs9(*DRnu7%{fT#Fo!9{8&uj8v-un*E!PzFv=s8N
zRGyW}vr>6hD$h#gS@~%_D>*zWRp!Uj%KXT5krdASNOFnf398Pw#`Uo&3u?WLj|>+_
zmGQxgtBenYa$1QQAFYiTJXOYrB0r9T!2L;XWooHXsr6ZbHJ9~=2h00tMJ;`Glmte$
zLqSw6%=1qs?}O5|7Di#8glL)Nn@H(2$x}g_6!2G&2F1M<u_|}rwIE~D^$r$~>}eqU
z^5*FH$Z_!D2~GWLdn`4e=fsHJAFoQh1Ws%+FRb&$_}w|<lz2No7&7q|8`<euy!yYq
zxu)I;6na1t31fpsks6U<I(V$jUu1xw2C=?&E}zWOyLR8$-}AW-NM&y(do;*QKQMWu
zw{_)lFy@a}<YGZ%5ywvvBzSk0VMUx0ckxswL6T1SB;au@>IqyrNw_@z$qzB9PKYYI
zLtCfH?#Sc1XvvO-)?H+GM0<Gj*&S3pS}Vt+6?b^()M{f>IUbp&1_M>)c&P2F91l&M
zpD)KFlVLZR;}JL6wm;KDhoDE7=}~+VC1o#%usO%*9cFr@_<u_KUhXW@L&rNseJdq=
zDwQv#@}*S1l**Tq)ugbQU-?q9@q5?4lpH>kDxc$N<#S{@MGEJ0BsoFygiPmK=Iq#%
z&9q)tM}||Q%Ie_7RaS>WIqk%(j`l{3n<}eAks>Vf^ykRyXsdFm{aJxEm-UDT%j;-I
z?Rs^T1V*;|KvXTv^-m_RgHyK_N@4GVXqn}ONbNSsAHf?H@JO&G)F;7=hqZkYnW^n;
zoX7c7+-L4LCBwZ|B<(&liE|w~$zeCdRx;Us5LK%fY^L0Jf-%^(Y#g-jA_g1n;nBxn
zxfok33fqnwD7sD1*i;lYQ!!wmswk}5u8P8H>im3B*i44qWE57XUTuFIR)?ZT7l$oA
ziIUQnL)e@v;|}AnDfU`vTj|c?uzKz(Y73RJfhyZ)3v8bpHcu5Zd0H`(Oe3an%p}QZ
z$>WfmZ=G?nDII6Ms7ZzqQbkR8aTPUDD5sMcHR)_b6{(^oiX5T0#{3j9la4BtI-eC-
zb6Jmgu$W0Fs)MVeBrvj7eNnYA&p(-%38if<jKWreXqja#q;#5OGq9VR@>>j~!ItK4
z#xlOLGRI_Ng1nBXPZD%QS)nY@YkSPfq-J~)FRZuj5~)^Wj1b7$Hd#5LtVrAT%%6JW
zn<GL&@wPVkp3+c{nmH-Um4ZsKcsh?D9n(PxyPnK~6CcI8CJhy7S2MDcx99)RQwnLJ
zCl39UT;rlQa*^`bHCrbjjmAsYAuq0>1&Rr&yUT@lJp@kK{TuMjr~gLYS;PCEG#H}I
zMP?}M+k7k{h4#>!Om@9s=HoWGyh+M374-!$O@|3pH8mq^P$IDw)(W(nxjzdubr-B8
zTK^AF-!xP-3$P%@x$oUeEnPcOX{-@RLtbds*O7~*W_%7wy)7c;nuduzE}|8*jEMIO
z>amTt3u>F3{C<4)%0oBHeBtRlE6&w;E>(!}0L?{Cpqz*h&EYkP?PST`6H&E_7-wot
zPcUNKkzFI5yNDP^dwBE_W2(rl6)*0@T{AiZz}Qs0IMXO%psIMW+OCQhYwG-b@#0K|
z-DJEtZd`7Ev{;9rM;9$FK8cdDmqXZ`3-=DA#VMYu(q5uFix%s6r>GaGg!iZN`cz(@
z%Ii~keezYUygrrJ=T5vnIlMhpuFTWQmC1D96wZ}Na@XVuL(jL&Ewd@>ZoN#I4EIZw
zDZ`7aOc{l8x`~-G-Hn)GRi=z;IB{L==g5}ns*<VuS%Ec|HHinymgz=)5b7uijBHnj
zs9KospG>w)NZ(pGg?%NWWtPt*qhsMenYv5k^bGWS_d8g5J0Bb7;PVfw*1G)!KlQwS
z?))0}nuq}u@WzNnTk4T1?S07huB>shnrczU8h9~_IIpil*D|jGr#P7I>?SlieOL<J
z)a|h}c!{RG;Pea#UUED@!2)XUGH$3DjhdlgHt9yQ>T<M#_jav$Ia)FfC1+`MDO#1P
zl2oTkRmtP)=*pgn?p>s+M0<GjsVbq)vsSuFH|`(NY2e1D(p5685(cVDS5ezl=_;B!
zKVP~^Cc|zrT}5x%ZGXy&4oQzLWu^EeO3GgjVROFJJ4{(gaTk?#)!bRiN)rDRb;Xo)
z!Bno7%JovYUMkm%zEwUKLFIZW+B6?t@7nc}!{t)ti#)A-kxU;-;e3%KpGlrz?0gG-
zBbzd@*2@{m@PSl0BfPlE89~YcOJn5wU(_rSD=K$N3#=+ngj1jS0x<N&Jep4ZZ|3Ql
zNwsC;j4i;^$`oOfV#SssC=E3`L@t6tjuU1A$733fJF!>O<sV!HNXN0NIv^6g*=u)p
zxx9kbR=k+AYCwE0y7qkg*L&_25;&W>phg;wZ-Aj-d~w~mu_M-<cmhKjHi#inGu$b(
zxbas&7t^V+aL2Cq70AM#dJbU*V`6(#SjU)~G$TMHaAh2wof?04Z?p)`iyvevcSBfu
zIm77_wT^f@`1nds@C73M!(ytPVdfI6G{*U99Lyt|z=r0{2TP_7>mGW03~v@JZBXUw
z#;#kxtQ$!q*(;2y3)j95jNcaiYHpCty9A!fO!m|<{E4x=at(O|)VYIS0U)#hdLP>h
zhjPHkHRgV>be)ou#ET};{q>O3<YU;-MCCuz^6PZ?0Nr!u5(`d*DY#9sLn@fc#wyF?
z9Zl>McLWB}Y)0XM?lcnELG#0qKkV++<v&jy*tR9rC)~mR>5dM#l0l$I8%|seF})e6
za8!Xmpqrm_H1~o7GCNIF^Vu*y1E~kOP}e$f1OyUCg)mhJ#lzHDWpqW%KBvPK>RW=o
zlhQWSvFN;HMe90M(fX&XXlW5X;{=gHj)hV>v*Y4O9H>_Sr{Zm~1S{vO@z`}8V4E24
z8pzhH+RGVEKwk+YzBlt23+uz61@$W(8Nc=~y|Ju$b<IW>H7`Wz1QeHW7&^^M3?;6C
zk+@AX>L=At)3`*XKZRtTQcaSV)aKM?v*;tu`11_5_Th#9#Z5#ssip3~A3x%Oy@=04
zRc3UONrK2nO=D?AM~z!_f;u7U6d5z$^6zxeRNB*xN5A)psyW84?xlA>bRsA>HE^!!
zY-HHF&-%GM12~tL>6{1hV`Zn)79ZAo_g^bex>F{=ojJdQj7q8I&E~6RDxVuf@wxH|
zwBKG{B;X<e8^w@hXNjF>ptLwdFb-e&iy^Yl@WcDpLoXP<M5Ad4AK&_kIV=Q3W+$Z9
zxw{;mP@)<Vs)}@&-dLs|7if}hnaQg_TI5*?QjseGBOJ>Lgi$J7LvoWR+AnDU5|%Z!
zD2bn8FpJgfXtHz@)0bGaQ{4W*(*3tPM0L{{zV?FUkj6=$C1huc#-SpRTrHMW$$wJD
z?tY(R&^1LnU=?k`d#QuWT4i8xdzzSt8mam>8hDgcGfo;H<g%y(+b<WZxDz4zlZY<-
zNg<IkXy&|gIw`tcM5O~i*NxJFkVFt{PCkTPUHHS}D|h^5csdzgpjn6gNkj{O9euUE
zDXz`Xn~7m%v3kCNkeWwxbg>SP9A~)nWmXvq;gbm@H*bpSh~t;`_=<EGu&IH(%tN#U
zKpsBjKdA(WKgk5ee*|GsbY1vIi-moYPdt<Mc||m-%*8ZW4Z4)sT}aY8M;|yPZ#kuN
za<mqWris`NJRrh_&dU)0N#XEZ6|xqGQ}BED+W+d_ClTjjor;|Ao17^j<mo}CXvdwp
zTSCxzw<1z}c64$4`|#MFrfUBJcJ7UV)V^>R*O;N@;s(V!pRA_S8zg#{kbSsY<%1~^
zpMaiot%?vG{vbco_kf-~FUDe-YnZD_)<PGTIKN+9oRPIg%>m^O6MCm-ND?$&g`4R)
z5Hq=Ph$O(V#VIO@GDlD9zXJ6ncjXHYh~?cX$>SscY(mOm6f7rZ3-N`@8OV#2Ax>u{
z7@|B&lwb-<bT1c+<YOTEpJ!v=A!Gd84}Z19PIq_8)8o$GNA@PyF@W9qe4BT|`19-<
z<dA*IMl<rAoArirn}Z(dPd3r<pQ!L*T#~PGreMigDYHuUY;xPJqCpP(mH*@bhd%}E
zS^o3vZ+AeV`6;y7u<}*S6ms~Jxr{mB<XGuU)0zKd!AdjkGMD_>#9z43masPEY?8<}
z{O{-Q-VV|8Pu7wvMLT<c{fKw00rVix3Kf&{p(d8Eeo^@N!>x!@l;hNhK>QuC&@N1O
z;S5g}{`|!MmU|fZv#yTMe@g5yMpWn5UcHg@Q%vjUKcV*jw;$fpy#~flqC!G4B<xsh
z(~*XjvlGw3F7o$~gVE_v&WgFJWpOk8DZCHhPm#R<e{zDwpJ%glPn_-t!?=rO@K2BA
zCFLF!{dxAcJS$Ggsu)$FGD))T4Hh;pKruNafB2J&9PlS+#avzIB(L0?5B_A1FS}FG
z;VZV?q&LU{xSnB_NySCYL<~T&FyHV6?4fZ-K`!bqWHM(`LlzFDMM)1lit0r+re~;2
z5Ya8gIu`D~hWLFaN2mipT)DQB8irNsACbg#@82T#nItV3fBPYamPIl{J~Jd6i-sI@
zC5xVGa;t?$cQ$P-==Q*#dk6M%Jo$F;)jF6F8+VEl@F3D+N}?7HHX!mcb4Kg>%FcZB
zx<-^GB=!sYi_26h5_`qO-r*5CYcaVO+43D{%RI|jlmYX)q_>+5kLF&O==V=|bmjYB
zvT3OlTjr=*u(Bb%1TPrp|DfmAKJhfHPw?>*32Z+<IN+(2m`NGbJzu0)@d6V|NJ^DB
z0r!b(`v~b{cq;Bk^nlzas+`j9&R3&rZ)qIOf^Y63c9!lF!9A@>sijUEXle$_8xC~t
z2Of@5Q_FMyfA-#WJ8oM^6n+&P&a5LjpSpFkoo&xf#)@xI;)}+TopZ+a;-b1KHAfWL
zL$d8?=j87^z&zqS$%g_65+p&O0Jfx-(=~fdEH*BMszRX(mnykmc+)I?`;-6kb2S*C
zu5lz4dMDxU1)EkX)S`csrQ#qvSE2Pa1WSjPIZflKk`_#Prb!XR2XS<s@I3ZVV-msz
zSv^faSx3paqR=Fb;dS?8#=i+`v{UAcc6(BdwY<!s8b=n)p$r^@_tL%}m4XtHmtmwN
z)L<q|Ly^NHvQ4;xYA{V|qQe}~-#Oe<8ck+tG*QvM<{?v%<EN}3wHZ{jV!tr~Z|Heu
z{8BC79dizbN0f!rUb5sNtbYaPfwDv#oQ82Jx6EK-&m5)%Ru@vFB$!UOGp1XCPH9#V
zs?$;k`<$=29^eg@uPJigZkmL0+h_3Td)y{CiqNCoYb14fYUV<4<XqE|ocBJQyu6(b
zeZ{|f>3kVpo`%_oEi5QHpRjr5AbImRn1r*ENNha(4z4^O`6CmRt~JZPL}sbwN`lMx
zD@_rP68d*dMH@CSJ;}Hr_cD+Hd$-O2>A8enl$A7Y)RqXr|5>kx(o$U70AOB9tAF{*
zj+faT??Y?oEhR4tC(%5j9P-c>4Xrhi?&5k+I(Jm7tGYOsh6C4QeNC2EXg9j=gVbO)
zFgbXOIiyl~T_5F~P~<Q2`U#WBo$<d=J>&X?jicx+;%_YYb!_VMz`O#__%xVY(2twT
zbH!#U&c$bi>+AE_Dx}_NZE#M$i4W%(1$(yg`J?m@g|bu?Hm(cC?G_{{<^kJy^QZ$k
z-q~gt!82NzMT{HU=d?hWF(tFj9x-LxFTfT$O^fR34s|!f1WqE~zdL-IUQ+p>GiY<8
zlzZ?y|GDvA$T-5G4k+xk96s}3Wa*`RbI)eS-qyQ>F3Wqx&}-|cpz)M!wH-|K4QE!%
z%C8i&qTG-$H%}Vd`{l{g;LQcLD+~|+Ha^pT$o3-UXkZz#*|`FJtykjAv*9l<k@eo0
z%U!q|k<HQWO-ZMIm)b~H7xC0ih`+paiY;+-`^567wz;+3nFVy|_Su%P&+YTm(BkY6
zg#bYNrFC<=n@yI0O%$mdY|JC5!NG$uXj^7P!)^8hAgnKhkRjSx#&qtpN-#2FJC}zm
zK&*Uy%k#Y>ndXjeVl`^+_}tWLgfyy+^tBab!_-*|sai3cySs5w-CKsJ>VDQU#zOEs
z-L*Q5(4hrRD{O}G;BIi++`5x)ZvQq5lj@xvdjpJVKoWhc+uBy5Ph4(k>u+d-RKE<R
zD~6IG{5+Y?A>yg?t!(*5_M4O(Bv<8*H8fAEH;iLi64Rhr{Qx*#u^wy*4UuPyYjoJ_
za|r3Mxh`jY-P(H+vtVDFw%2vhThu$4V#YPi$XH{6A({+z!%f$QNnvZ5TXoMG`6V|k
zo@iwy0?9D7(|(D8Q#mFn@T#aeM)@^H|LIgHg%MYpaQ6;f+5sUBJmmwrxWr#d(eRwE
z|JbTHO$#8bF&C_IT_}_;80RSmEbg$W!H#9|I*qdc*}k9+uJmVQs}=E5U67<E;3!hH
z9KeeJM8igYnESOGjed#M=+C~N`VmB$%$}WAGf5iCc<x<pG@~&a%vfW&Z75R{0)}1C
ziEQ=8(cW4{FFwT9O1>ovS^r)U*Db=WG-BdlFyG`%#2UvK!`LL0cq3Q&mJr7?+xLTe
zI|fTvZ-6dWlNb%wzPk3RvX@y{<%|yPbvsHK_pSk@_OOo-miqWW>y|Vlyy;3p#wUa!
z?D=O=7*Cmw0=sG}((yx!o9m;7-u`;#SnpJjVv$LE$ch)9%a{dHXLZ;)tIgzVp8++B
z<~?KFe2`-m4_XlhZZ_NaI!>C}UGfg6ZQYBxo#Y^O*f-2;8B~Mqt)*3#Iix5oQ~U%w
z<xrbzQB#B61AU7fgBzB!TEdL?W*sDIz$4nVY*__-TU`n3+!tH2jCCb=EmvxAze2gf
z3#H=?NC!bPIv{JgQ-k&8NSn>>8y2^I$8edVru8`1Vx|W7J9#Ut-c&YuzogwICSgP9
zw|HYJUf)-fH|omdA%;hI%jB)<v*M#l1`x?&kf~zKH_Scuj?BP(`OzDY_G3@ZSI7}1
zKb&jiEK(%C(kB9Gbo?d|d9qAR>RXJ;0jzj-tm~4t_NT7+)p<%AnXZ}%$P_fL=4m_E
zl1QwiaFUyeO+VsjrtF(%wN}WmH;bmzFc}?(NkOZ}BCV#7C)?bW{Vg_AL1AiE*}cT9
zQW2m|9;T8D1^*!NcoFs8#jLL#U*$!3d64JPd7>~D6b-j?-R^!r+M)m3Rq&%H?`-w^
zQWZ$M{g$e3kEBBsh2*yIP>ircj53dyqG&QibuDd*h@?axR4AHmS$Weahpe&#wJ=bv
zcSVc3lc13kP^}ib8f`fD(TSnEY3Qp~@#*NRDwUi}mXlq+)YzK*@@0v`=`L%wol?HS
z%qSjnIUjsq4{DK^^kr@LMdhcWL~k2a%J#B`vQS_0c2lzCvbs8Pd-bzEfqPXfX)QZF
z#jF#$3s9Pq>ICoA&mEkQ&GsaIuYO04RhtODDrK7xUVu?Q$bWur^sPxcTZhZFvme^e
zCr@S}5dz5b&-R37Dg)clf3Q6P{wyFptFjc2J3Uc7!>(=SQK5F)sFgzA=V3-J7qqQe
zKzj^$hU+@_u}A{lRSA1z^7ga<%%t3Yhf@}TtIl_*(2Ha86oR!vXHb(TUY{>c<7h(4
z;4GcN(0Zq|9xZY~(u5SVEQEaCMNT%y<MBNL*Pf_`fZsAugCvKbHD&T&778T^zs6T&
z!g`((=JSZ&7|Jihf`EuY=pd-1!DK=)N#|Fr7{nhVXIXm5{$dTBhQ-$~Ovtv}{Pq@^
zhH!U|L<L#o)Q_dO!dgwJ2VDM?v62&LI$}|}7C9wSh34T@h0L^#3>|bCjYdjp&M*|i
zE1NA#joS}OK6eBu&5LJMT6(1<efJ$@tGF;jiC0@r-+iY*`fW0y?5mn25glYojcAJN
z7740mAg-*`mTLG^gkPpGD8}R%{0$P!=j4C>>%W=oN|>;3WoWLF|J9E~Sfgq|=Uu!E
zsdfrt)=oHu7=(=u6jk?y%vPjP6uLhq$J7KTDrducAX+#MR2g|F;pw~p+5N3_vdH^)
zuWpg%Z|Nf2W8LhPk}6}WD0VWVn9-leBuF3`H%KeYNuI)!$vJZ?$pP(h8f6sExP9E!
z5n<*KMLlZp@JNA1slE;EmTsq_&E6$%NOxexy=Ot6AP-DwSKbFFZ1>U0?!(8s4<6tD
z+j#%MgMaU=23g1gn!QO2wGAg*M@sLtUh!mm<TQqeQ)-7JNqZI^QteL?(QCU%+l7<=
zl>U&-5^94^E`sy$SB)Vi%6w3pf|Yeu{@xmws9iZhs;Ua_N7OT#b8?;1EIwvWcO-oG
z+c~C(7|^2buNwQg?fT&j9?|+ymQEKF9fIwG9Xz7}buH|EQL7X&AzsyN8R9FJc#7R3
zX-}c+EAEeW?kj!8+DBB3L^ORo4=2E_y#^(k8wpC^vf4;!R_xi#@jg;}BTNA8dXH*T
zy|1IE5_M2}d|lWe)i}F?_k4b}wu>5*OJZ)VR(t*0wwbP%`O#rAVViCvIAxfUquQXS
zrfpGjMd&&LGq|w_<3S^Wd2QuvoAX}EZ2yQ$(RRJ+i%wLT?G+jAHPdCUHOq+p(4x{T
zr55R~KkX#qRwP%fK9^DQioL3(jqNH{GsB^h#`j}Cw*;gN7dlM|UG>OC7|uzx|H3@B
z4apj3DTB8NyfgwEiu--kkO?E|f-wh-O%-w$L@{M+cWbu!q3xS{9q&y=Z!CRa%7sg!
z(sLF~m3y*h)U_4(IS&w+Pk0c@{(Ze(<l7?Go1%L;;}*!)@j0t;L`hx*)IcAT&2W4^
zCViN6PcKcRlALpLsJx|MrjyHHsry;F-!cYYAw@I$Dx$&@hzieV05$em&`QNw1Zt4w
zuEVVkQ{b?qfy#e2N8LD&Z!6ns#S{lk&CPkH+N%T5PT^5&Ic}c(bxnOwvH#!ff)%iC
zR^Iz>wzpbmwg<5G<|XkIu8`+<M<VsqKH|`jVSkm$P#s<ChQF^H{=TYqF9xh7L5k`)
zk?9#a^s+D=%|`NB-)?16_t>DCy0zWQ$0ZxTms;cZH`(}A5<F2IZ?=?x=uhEhcNL)d
z5C?<<j613y;gu^tCf231g^Xal*z*Jipe{t$*(lLw0kk!8RbtF98%XAFc_3TeKd8}A
znZFe(T{CzWTyFJ=KEd48A=ukG(kk^<ck!|J-dOb<5!J`B;X+l%K>GNR*0^k(OSWxI
z<$*khUaZTzSvQZfu*h7HZbpm0G2Gjxjx*{ntC00KiMTLCb!e+TtH<J%yTZDeS1AZz
z*f)Mu`i`iv+vRY=-KE5&Ve%$rIDK|U^09T0{r;Q01Q%4_DwsYlh<+ejO8%Z@IDO6K
zOzmK+u=#@TBX$fJDYl&jSlzNyi>5J12>#7|zmOU`VWl8CW|@IWy1tINPt2-US^yiT
z5;X}}LF>D~UyQ!Gs|59mLjPQMxYjRcv*cP89X$KmF7~f#)DX5!CSO;o0}mKOo<V&`
zkE0cbyAlqhsVLs0{&RM}6EsB?7!q=$9%9xtoXTi+3Fk*qLiNV;-@^&pQuos{pBdc#
z!F+C-=(s*v$&+TtB)Fd9SKp@o$t*0p#q`Ts6l6ca22ZlkU#zfQ0436hWyG%E)Z-&3
z^69ogb^&zjo&blKMOxW6{;Wp|sWn+qSh$|TzGz%Og8_Nuw>U~MtYi|URWM2vK(86}
zBQ%E)W5v+3qB9>w&`Qt%Y(ROAuok4|EV^dp>+Vld|LH8GR_Wmx%*Kr2z^<fKfq)x2
z2^(Lt23zC+M7~%^9NnKR7Tuhclr{nKVJp*{W2CbQXjyH7R&twwQ6B;%hX_c0k{-Z2
zbDTlg1S|DggUh4%CYT>XsiD65LgmY@OQ};jY^v>5yZ$;bC}J7VMe%G$=V7*>sQc7H
zP4e|5V{nHj85cIYUgdc<4dGIw9Y4`?$D$~n@#y8<BECTvTozUU$tb6beu>c8B95<M
zDu!$_))s(m>%_@KZ-S$+12nB;H)UWU695*4@gg)tuh!uvsdWe1wN&?w-3r*SU}iVv
zGjLll`)=!7oT=Uf*Ll>QNid)J1UgIxO`v5=p+S>~*n7ck&<7T_l}o1}!(EVFbv8O8
zR5O7b<Lx-a_E?%@5_iEyz6Ch#0kpwFZvj{pw<v5ge)QgE7cje>U9jo`z+y+V3(CmK
z_EKmYWw{G`JG-`(EHpZRg@9PKZ6!^{E!-~P+t=+JScsK(mS*sXhv`z=gfcd~cU=Z+
zW7oE(d!GQpeH<KEvmch{z6lt#C=<&dm1=Nx=mgY`-IG69@|VqxK1pZ7$nHJ4uGkW~
z$nK&kCgYq6tW**Q>nfHN@Y;sMfb|i;ZH)x5?h3#r30D{3u3A>)zeVgefCJ7PyeAl`
z;zH~y!{8~*;En<*?+ZG~r`0-GgQds;SXZ$`%v!7+7HR;CaoC_#q4T0#nz2>!oecBg
zEoPMaE`vE+x#gT(v8@EbWPOf`E;ugn;u4wnM7kj%;%l07!ZiV#6r&4EO_R|D8x9aT
zl?D?mOCq=?yV!2jC_~Rf1)l2;j{{o&;K{O_EZ-JF;jSRCXHDORny|Z9+J%8?!>W>V
zHBxP%{ZwkJKRzY!`IETu|A~J5#BTFF-rg2(rQoSlK917rHoy2`1i!G``=7im(NgIX
zLQ5a{H-JCtfAV6?4dLA#FHSF`qH01aLz%;iaIqWrmduMQ(b_!CBS213Dw=jW{KOp;
z`n~>KSNoIy^K&&gpu2Ho71k%=?**I6DvYCll%?VzJ6B=*H3VCempM&ix*#YDF=d}7
zMGzmv(Rl(7GkA?j2ruIFq=IE8O3oF9CTW~zyihQiutqy&&S<wM)mY0Lt*UWk!5qrK
z1;AdG^rHe{ba)v?N*0xeX+;Rgv|YwyYA{V|qQe}~9}BlLn#|H@qN07xL#C9+Pgy}~
zGpT6Beq#dPSb3NuLf4({nDcjK0?%Hu<RPrr1?PdX1WG#M;53X&ndhN)c(^K96d{aD
zPjo9qOCjvHzvjxL(O{Z{a-(NamKWnDJH)?G%oy!nBRk3?bQh*9gW|mR0o3IUjM36w
z)9q;*FD{cFim~6?8e700-A}w)yYWuTbx~${^|UXbryl`0y{f2&U|Y9Rt#qo$Znd(3
znKKWwvoyOTdFjBFtYMGIYlb0ulC@)h*|xmOa4m$RDrg=|m_~+*Z>S(5>eOUwOucCC
zPr1v>UwhN}_sJv1)}oxQ$fcE_(1G0wNLs3Y`rOkzZ8n+~Gd?Vee^^Xr@&pvnYWA}<
zMfpE#D?+ksN=phH0m+6cW0UYQyW@T6&tVJJ%fd-Cj|_Lv`@x$?59++857~Th2acpQ
zdbES{>e-vB`SMYmt(OX5;{<T<7A%z4>-voOWCqc+>i7^@c}VlWEU~f01vXZrvxq;h
ze(&_$tP6HXpq`|4!RnD(7jVzkShPUP$7)?bJNE#V#H*gTec2uFY%_czHWJKg#?$R{
zS|H4r%ec*APh{IKz@j}(i|XzF_LD!t1g>Gce|Pvay`+*y=kex7IpttK<DVM=2Q0>q
z9y@;AY(Mevng1e7FKsh3cENquVk!G8-^P{(`hj2*Tz4|W+$}fUY`P?kW5V*3d@v)~
z$qz)3+4xNVA^RA1M~v4sTclZXOE<X9b9Oxw2F!$dPkPwZ?HidBqute*6^{Aix-e{7
zXeZ}-Rt%UG*ran!aJ}}@bVNHdlA2LI+ngv<W1oiH7g0K|(s7;*66l#?Q50DaD;G|4
z#nWA6vzsLjGXyz1&=jz}dhT}jt^K0<jr>-Fs=Gy^4FRKqp_k1a=QA00$y|TI9Q6Ln
zP`VZ<5$Sm{ou^T<j7#P6h4MEkIY_SLbPm<S*)eGc<u?IV>I4kF5RTLb0O+E~g4nS-
zUT(9$)P`;v!0i&-fNSF3lbFSM-L$<7Y<Y(SV8^ZkQl)Z0N(TVCC=vm*#97`u!?kN#
z_K>1fA;+5gCC7UQ4hmaD(PIj?{Z0m_Y_ZtU&Z^*nX#9vd9AZCs<rJ~42b5$tf~@Ne
zLYD&%q3=*pk{rsH@SNIg_Kn~qy$QmAABHm`qpup!N<@JD7`?1K0d~>roTb)%3cA|X
z`)u7)#R5bU?=IL<v+6B?Hy2i&S#a70E7$QO(LohM6v7P2+FkSPv^`$_Egd(+0*@NM
zjk9L&sI{Fmu_eXm2ec~<baaDckdx-H-V=A{?A9GK*(vKj>ct^owUKFo-5@^=G5G;d
z#Sn!s<8tuH?EEoQlK@U0mGZ$YPD0!t+3xM2-718-13)kn)fS557Cw==J^OV9ArRJ2
zH!KyT{p*TrdR1YjFM#xl;^p%b3_WNax?p8izKQ3bMPWQ;dJPQHtq7;skYjLt%Yneb
zIC~5Qv_I>IXQe)|iW9*wOJ&(O&Y183j^YZx4_ElH-o3}8KO&f7)K&(jXzLr8g3@rh
zHdL2LDD(W^f~fGLGad%@w;(Ctao-WY2<pFBWN@cPoEE02_>UHbJU^@-5U`jxf;88c
zL4W%vHE2bSe*c0lNLKS{%>RXp?3(NF*Yhq$y1J^pU0&n)CS4YqQ^;<%m>4kSifH{*
zhkQFvb=q)E*V<)P{e*oEV0w<ztzmpXa0<D|s3NX&$gdv^tm=b-zILvQkd?l99ZsXg
zC8COxRM*4@W2Sr$2Cu-%Ct<;9`(ap9SpQY^3_`#SK6<c!=FocBpnKPVL4Y(LGW5S=
zKv>QghiaKm70mrD={bU_BlMF4>qiFH`>ep^UYdrzdXEJ(BhtD}*7*UJ<{K^3VOuRH
z3Vlfv?>mXvpxOyAX*<-NWH-{Y+b%it5Du!@r&lUN1l8b5>qYYhxYIU)Y&Zi`omJXY
z+Ek#rH|}liY|(O?<!vNQ!FyYK_YB%y$B4e4`Z<K0`E`WG!z0tYMa|jX`Km$Hd=iO0
ze^guzEfWj94(4+ZPvrGb`?E&0bQ0Th#p*Qi{?2_97OZ^pMkXf!DG5Lr0qFnFN~82=
zuoz5@nigQ<a;m4_G+yp(z-}^QHkeJKgS-uCwE?Y29j3ZdkFvB;X~c}%&#v5aQ4q%6
z=)Srh6aFa7{SiA@17X)rQLNfTCpx?xjjG%}?w1Xe?y94+l_^SLlXnvg4t^Pky@sl<
z^szs)Foq;xf(!aXVwCe@<+$LSmfK0;S)WLPKcb~e<=uoO9k*vXrQL%Oc8(k#EoFvO
zh6V0L@OmmVI#^Eyb<yrri29QX+D?S7$o9{Ivrb5I)l$R!G5#+Nzj4-WPsTcEoku?9
zD-X)R#r4QamLUx5aH|ccFBUgd8c$Bm%{C^cQ($q_M6C*UJwlr&ly(m%*^PK6811mi
z()-~zVewOx=D;|_{+Mxx%viu=!DIOR1?k$e_HfHYRUFa1O3V<ZGjeSaV7_%>6qt@^
z^R1DalWicExfh}hEZ--qe{Pu{@|k2&yNKxbfUu4nD~xdF08m86Id!b8jbjI3p(qec
z1wguZ07iK?veQ^#8GE?;i%5Mx4c{N@aUgHkmVKcOx^A{_*k0cN+lIObOg7=a*JamG
z{eS&d4eg}8)L3p~v(|93R2A><e7(+T3SZAUcX-4^`CvMQb!9p08`9RY5db5B{)+Z=
zn|DUW8Chp6u(n;AAU38=tU>Ke1FTJ#@`q)cE_`3_P8u$U2^~lfNB;=L-H7I4IcBlO
zQcdcstC`PQn)%iVT4QV0^e7GQRVPfQv6&Rupeqs<Pu-o)n%o8OSy<fwVheRs5|=E2
zA7GvAc4K1ATI`5-$|Cp$EPCIx=Gh&VJXbfxLGGk?hX>+-VJ&fLaKCMIM?|e}<y)q}
zbvp#lD49glFj;{OmpdhWSWm1PojJV7t&3kv8kQ+~0}}YH<<53DW|ei`wEg5B6L;M~
z;CPhb>WzPIw&u0yslhf%`YOvDQWTace$}&rr|BiUpQQg?n8OvV<qer}e05jVTFi`h
zh8)DI%EHU@igDM~MESK;aj8PawqIS@QaOyvl&-GquH{M%?wJ!-c%5`iXy71d#_hee
z+^NAjH$gQfL@dc07Pr2&Y?*>)I>=bdnHnlN6ImmD_;A;q&;E`6Wy+k^#a#=W8k8pr
z`~t&WmbcOg<WH9}{W5x&m{bPDv*nGcczuINem?=!dk@j~R+6`E2Y;EWL?u9L4Wfqn
zD7<7y99>5E)k=h@H<hnN6#ptInDVQaLHtZ4G%JzJnbf$y__3C3)n~;=l_Yreoa|$%
zCqH%S=ezl4n%8<GWso8H`4sTx<40OKU1XE+aJsqiI+|o@o}Lxs-@?;v`7zcOsiaRT
zc3gH_zhq<g!tdSFzb2bBigPq<n%B1;l>?)_OoC!_W4jS0Wt$E~{;+v(EdO~p-69*?
zR4TtjQ_8;WCPhSO7S@V{@z*rFfKXZCNR${wNla1SxChN$21#%pP7mf$zI`BMy<>1D
z-y5|X+qNh6#F$KM=ZS6Gp4hf++qP}nHcx*4_pMW>>QwF8pZi1i?(Vg&weI?HmV`7p
z(UT1{?HWqsnJ*!sCe~6=rdk~bmgxQqNwB+~tp-k;^M|j3`Aj6LV{)<-(E#<b1?u#U
z@whPvFu@l3$<?m~^a%69w-<Rfhp4@sGZtwEcQeg!N8tpOQ#Y2?pxtbFf3;exD`-DQ
zj`G~py6c?|(V$K>mcn{-vWGQsSI%IS7J)2;`1%C($L?rVrB-CvdJZlgoZI;0SPnaa
zf06k-#%Jd{posktUKdd=jI2JW1{m>D!qF~^1B#)cewnc|ROWY3RsSF9xMms+9`arc
zXMbzz>Ny|(ty>G+qlkDzbb9;gCB^z}pvAD1^`C}`*I4<c_xOQXd}TlIV1?OkE|E#_
z9ik{V;$niVlKH$C=OUWMl2T{LN~QC)Ka7?l7o`o(p`)`F-E2@Pyl4}!gTmcDQISp@
zP?KIlBPHS+#-w><tnIx;RMgV~OjmjOwI8is@(wo<-%2jr{@2%}-8Wq!IH@TTAvvcI
z+hjA1`EeY+;2@u`<r38E%6fhu@OQe&ZZhRZS$zE5P~2olnTPqirP$NF9fz8sV`ACO
z#tI5XS`Ckg66r9%wxt4sNFW}BnRXIK##OCxsj)J(Pra+0Qt1`t@^%-&0twS@DR8@!
zm;7rf<?MP;j1`liQ7!{3w-RO2#@VGmgIDJqjU0!J0fDx{Y|wy#-k(P_)N{*Va<|ov
zwTM%@ThOFG1(=TrG9$+KgPvK&o$UrIwF<RkSoeMvVsB68JY_5NIcQ)#(}XrQ$(hml
zb+@-<og2=xh<Dl9xLzKM4_6T}!&%9Y$A*v|cb9L&NFwZH0tBPWlu>Fz2Uf^Pt;jH`
zmrVywLWUT}?J3~k&_a8<eI(?`Dtu~iw)_<cBuX^37yfQaCC?WnOfp0%<gJ=B-p0TK
zCJ=aeW{cFE99(4GL1FWfHa1dQSs1=-8nj~Au_?l))qeQp4JRo)lLBYxGgCR_za*GQ
z?+4BBq{Xm>T7P4yUneZ(3)73G$)y?Ui4{@(>OFGh=@LEiR0Q=N|7#YPp#U|aD0f$X
zGbsMT+C_r8bf3T|tMf1<=Z%f=gIDP*3;u#9M-3C_>ee45+F|7!pObvTwAf*x?F!Np
zXgWM<ZXRI?7zre!9w7;y@u$*Q9VH1L&t_J(2ay(~b$%i#7Al+J$ta6SZHmqHrzaJS
zH*eg<3foPbOe!3@gzU=Z_DeV#thXg7R;fWPODMSR%C|(Piln?X=RR-0Mic9nCQtAJ
z#FORuOO;lO*=>^W|I`vi#jh#AXNTR4qd^R&;Q1#@`@Lp-O#6JY$7?~OK1F65!G5Xm
zq3lAIf@iwiG8eSbhNyAxCe)Rz{>wY-idhX~2@`l8K1gv-b5y7C_WTjSi{|GCN@_g!
zN(^UrWAk2_8{%^}?IrnVjjx$=E@kA~l+4JbdQRM?NfNV#Jb&dGuXx!uxe#Vv{PFB~
z-?{zlj(jHMd3lcFnxH%`?emVuFpn2yBTr~Ydjuh7*e+%Y5La107GKME6L<O}C{%q(
zVs)+drT8YOJy<%*)(SP%ufysbPI=F7#R(V^d-br;%yT~cT~bD!0WLpn`Z?kxL35W<
z*c*GZNqEh&`g>pt&B<pmCEZGPboCEXCce?BBh&2eI{gYiH;&wLpE*XOL@4T<vUC=4
zmU3wEk3-0FS5@4|x7J$y&|r=z$%HcdaLbbcbpM2#VA{4TF<oKbpN{VFbkh;-_z92t
zw|y&ZL+QHav{Y!boj?}3X_U1pZ-+PAx-znTNHab~!(vsty2ffzS<zRfqW;8FiG<Nz
zWb&MHYE<6pR$;%2@|7q7{~y)HO8t%Q5tMUdW4&1N;tl#rG7}#o5U&0N0!ivP5sJy>
z<;9;p`+BW)oIKPdvGeRS35|(qg2R<GqW4NS;Rnd-M02V|F&E&pJ2Htq_sr0dF!18-
zb}DXD#@i6OkOLC9;|Who0!y)_eG*{Q2cCkaJ&lmMZ`QHWOc6Tzs~Iw4)di~D2~{wr
z#ybB~AKH}TIWtrg^xoyMZr@06a?1R*<DLFr0wwGt@<7HcmE#pvk|E!l1eyAZ+8&!F
zT3hF?Jk$sP>Anuw_p340x?RqKvom+iOk{mXpmBuL)_%i|<9TEOrd{&aj@=XnvlWn4
zu4yUOD9TaT7IZH1^xYRvsW-;cEw;H!NS4#3mW8>jnv05zHZ-N-0Tp4EQ9avu76?R=
z$+Y%-DHSD((zmqyBzK!E3THa;(-W75<qOlsD9guw<&}}FZTz%_#*h3T9ozgz$Id^C
z2)~q*OG^kmWn_<=esiWd&okj%TBwu;`a{2p(6X=w+&${-8;2SigBEER{)L7hrb3tE
z;?HlcyO^&Iih_INKX-<pA&QM8$7ED{3=Q{JE2J!)GE^cnXUm~M^Am74DZBlvJ%?wt
z6yd;vMah{zP-6Md3b=`oSCLf>WSKxqxoX^%cew{~PAkeNfLu$*J*m0O)C2zICAJD9
zIkG?e$-c0=OM$TRyy^=_p5Z!~9^R$)g%;dx(d03t<4zz?hO&h&5GDAIHO3fdk4P~4
z6VC;<Axg&k;pxSYGudH5i8-jcLeR+k)X*|Gkqf2{?+VKQ^fb9_h2f_xR4eseW;<vA
zb!m;E^)wMX?4Uxo)Gg<d8R~TWn1c5t?Khlzq6F(hxGD}8`bnQ41yNOv;5$%O4dYlW
zp?P*tL+=r>0Q~1OMEXwV?5|mU+5l0<hO%8THUxr4tsT?l4`u+o^})XHFA_+Ru|F<q
zi0mPThQB=VtdTlt4^&o4Q=K6>vgr0~4>=LUl9Kb4F-J8E2;0TcZUe1E_G=w3Xaho@
zkaZ%brNg}qm)2Aa^et2>=WLu8(_rv)8oe@#K+~T`n0H>)A9WG7<v^R<%+;92dz{nS
z#Q7wy>`K<>H&<F)4ccWI@z1ghO>b_Z)Vktxpgu?*2P*-n$1x0#s`3^8Y?K&Fiamg`
z8y)AkA^eC(c(f`I)>2FEoI(TIvF2)kmNuG#$=b*f4KN@SE5m6Ly%Mvc2aNV9CO`Rl
zN;1a28U{*yv%R_?jZpxkX(1E(6}p|`{!~ACmWaozl(+WwB+g+VxVIiL6wfav<&H6a
zjEQ_JF0^N%9WTB|gNTf8?e1#Jw40LAE$&&?6dlnd9Yt~R>Wm6Gl5Gl~f^ZP7SsQcD
zjUDn!MRoYxf2x=YSKIMwDS-zTG4Vvi#5v+qefrG)<*u5uF$%K>1q&<&eL?prP{O5x
zve{EOJuLSe;LB$Iz_iQ^uCjOo!?e5}+}v*@Z--v3YXVXl?+M-Ni_7C+75a&!FC~+~
zs7<QL^q-d{>iiu>mOiADII@~A74%q{1(<pQ=%HsseuSeZfRH8Es$|PC>r7LRa9RO%
zHCQX6=&sMtKTHj13FoL29cMS6?JCXmaV{hh!M#xIr3(9*@yfRhm+!J(Z<5PV@n2d=
zQq4w|H7pL0(gC0EhcB17s4mNK>ol#)I0)jU+vP1{KFk!S<5z5=R%CEfmt)`S)^7*Q
z<EfxqIEpObk}pjZehNJAfm?eqXcU}xyQZWo(aux@ng7)B8ybZXTv!a7k4xBJ?Aj%U
zth&6fb3|E`ve5|vFT~cPMAsv_{phD`niF|!JRjkcgMGPndKYhVE{$uz1{2MQ)siLa
z*=-76Dv@OOXl@Rj-J?zyDQzc>15ve#NHF@16CqDX+zSdL50Aq~HMoW5Y_t~2S~@dP
zy#{3dd2SoJw3rXL^)}>b!(WY}_a}c$sLN$;s%bpdRrOh-xBe{6@~l1nY!_C@Rv%Hc
z1qA9Zza}(n7D8N~p)j#j(IC%;<#jlM|02l$0A@t-!rFgRppej>XzM&-MK3w+iCEZ5
zBQT+ikjWmtql*?K3+b{T+!B^^$p`v59X1fFqi*G?hq8zW!-^_M`53>?n59YD_ImVg
zU;_NGK377)`1un55wX0e4+iAWRT+vw70<vQDj1o!Ghp>^i*QHFI1}=0wST)F&%V50
zKQH%UE%jnC9`)tu!Wlna5qRhNmk7TE%4os<7G0n=k{VHA)e1@(ipNFlw)MgH-gWP1
z_+Z_m->{LUv=_9)R9Z(_%Y1K=?uufP!+60kfNKy3;NErGt6XB!#}DVk5JPBYYuqMk
z`JWGM=Qz8d8_sa3zD^&FT#Nh-^iNu}xlpIJ*i7vZUb1|v%FJ#MWutZXe|Y~In-@j_
zLjCpRlpuGhUAeEyf+i!GTd}YDv&3qm3}y$t0{2xrU|$Uezarg~X$8^q!KZaC;*$)n
zle56r8p;R?V8**@7;)OY23b@#1zKc4cKz)9Tl6l#*nb@aIV`*!40v$CQeb*J9^JdZ
z{NdTVd3JXGV7ZT1dQTeL;G%g1(KdRS_KCjp3#0NtEve?Od8Sm8KQv%Z`n<nUa|xAa
z@oiOup7H2J0CJN*SI_<))Z;G-A0Mab%84O_QuVy>)kk%9eBEM8{2s0u)|g>fxRc&D
zwFhwikj>v8OwadC1NYdjqsPaK%K~5bTf@`ecT{R*jw}oN92y_{gerV!t0W1xD{l!r
zulZ)Y;x1=t)8Aho2_M~ag=V@R2DVw&SA3p~osi%s3NSR0FmAlkqvkwF36az7_XIKK
zeHUk`cQ>5?aEZJtmAExL!`X3%YP~p^ek{uJ&e0|F@-C)1HG_2Pj#FmsaxJEC4^KNG
zNqEta{1T@?#+6>7DWVJtLAnvxI+yGT%Dy+;M+pA8kCJ#sL}o@l#F9P+g>PL1-1f#Z
zK9=Fx+o?IYDTq~}J@#VsbI5kCN&4V4ZSUPBO69tNq&+Kt#&Y#?7t=j5USB9ELW#s+
zU1H_M`aXd+!GA_9fUTZ$r3#zIdLZG1I(Ka*Y8uB26vqYM!i7E-ISqnxBjgUsLoew0
z$Zh$X;wFB~Hbof|#nJ*0Z}mN?12!sFP$CXH+{k_tZzRQlVim`p6aG5qNt=f9JX6E*
zJ3tGpCH$Tt+LCVJZw@g#5;T|`QTH8mQj}kQ-ZHCTh8<Alf00>JE^={Zn)Kk8l=a~;
zp7g)Tt2!T5{rN?gb@}<Z*Xtn0OHf&JApTJr((03gym5K~fNv|bf$}(k!cCq)Iw)#9
zux7-`x0MnjVOIo_(L_uYuwe4__UoB~jNo_v?v0sa>H>=_k*x9CZod@h^hjg#i3n~`
zlDLc_F<XM3(h-GYMpW=PUjhQ$K3@+GPLe>|s3X`lrS<XG7H~Kbs%E#yl=HT<mvpms
zK-LcG!vWktf|~pne>3zMsfVI2ss<G`3!mT@|MYbGR|1O`ml;_~36dsHe6B?fxuF(c
zQ%oX*TR-0Z9ZW5NX>53)r)d);$d3+wyzDCE(DYoy#<GKrQu<AR<}2mLL2g2uvzXHJ
zx%Cp(p+QE*5e%0HEC!wGi#y$CC(jDHq?ZHLJIJH~xn2fK(g70BveyYjwUQ(uGC^_|
z8L&w0q|BgK+a`-DXpGNE)2R_#uYW^O#cP@L6`}`iKb(={WLxn?D9%0*^C~ph$Ly$J
z-w!U?`|Zut?$2XBsld{2%>%JO4LjT@eCl71^c`RYi!+(pcw{E|Xf?Dy{#jhDEN-X~
z*C0jQxQe6&OLaS-?SoLkIJ!DUAG30fj{vgBc($}x08xxf+e{`?HXRmC?fo;CgY<d@
zG0NXWx56_3j;t%SMUm^+a*lG!&i+brdyyR%tlFoknIU&8#r5IOtVY;hQ}yn9k{S1E
zXD#!J&r%wp^O0a)o8k9$^<bWg@G6lJL3G#+k0pynXB9fs0_iCP6Esv4eC^tgS;ux=
zeC=EE!$IrMP8t+__A))@S|11Ie^E3KlK~qYK9|Jo?Xi|)WvHHTm0N5{SoZbJ(M}_i
z&YeHouq){b)6$W>fh9@{7pK;M9=5&%zMNvi!!lgS>gVTfN=Lr6m>kmC$%F%j2z6kw
z2s1R=W7qptL;tAuyPcY6Cq&W~5M=b2o09BgKUMnvBP3V$gk7b~SSsQ00ZV{~;SH81
z9b!4Y;N$!3Ret<taI^~{PuF+z?Uz5~Iab-v!g{v}Wl~B;`)L%(6~0;cIr;qo3)F#<
zP|B>bK^&YvCx6yk4u5FT?+%147}A=bE$E=+;it{lu`eGxGO9XmREH$y%zx>CWEn#Y
zAZWH&XV{XxhlW`n;|0rhyT%HiPPQeU0=96az=zoWr(m@RrIfo_IDL(Cw=!4D<tl`2
z5oG~+A;0V6Z)+xSg6Rr^K#4*h$$ZRKsKcbDTn;}ku{pEo0;DCxK%h)OW0o-|w5gM)
z=E~DcbfLqvMqCdDjLiNPNpi2Sn7wIriaZ}uTJp3bw9^-{ueHok<dhzJP})EP1dmVd
z8DyVoS_tL$YC#EG%N18hNs#S1QC>5l5E?RFT$CR2$-X|!k9V04cpj7p+cbG{71omQ
zn&yw}x<$`X0q2G~a=65519sF73X}x|=xEh?)rzV5%qUlRd|M5LCxR%Bo5Xg1#36dW
zvdHSl=e2wxBhiGlVvN9$5Q5g$WkT}v1uAiy6r@sNOT2>fpz8w%gK%NrcYNHu%I0+f
ztqkAe6u1b8+C(=Z2CClP)yAacMY;x6uL^CpJQrKuveP56hOuMTQ1K9%p4=$g4XPso
z-mY+Kc`q+Td<lvBBBG>Py}ul|i|-ti#|lzLz9qCa<xi16dt~pQcHvY-aVNFLx3XE-
z=VREdALq;4$s5Xao)<N|D8sjC#u&@gFB)+m#VJmW@6OFRZv!1SxiXV(;p7Jz(ir=<
zqKo)gilS{*b+bONWyRH~O^&+j$e!U`Pwyk%O#kS<3#!Sxk4pJWQ!LcH09T?774lWi
zv#Cm-CE^AFHfX6|>;^6eF1JN>y1nsd0jKs2BYTYhAa}V4&Ke2>i!3d~Iikddr0bxJ
z9-BI5ZYlDm@*`{`Q_ZDz$qa4Y$G2Qf(q+T7-5gS^)bW{JpF#;t?P_R0f0z1eWP5x=
z%xVV9{29?Msc}~VT^jDVU9m&7pq^wawaY|*wUK994{)-q*KR3Mxp#~;vK3d>I5B||
zbG4DwI7;Tk!ujnu3Vp4r5tmky0%67^Wiih(ozECP|KP_ZB$@m{(27U<yx|+KVHC~M
zEgpM~O~dxLlI)qsSdb39ak=gGRmV*Uf*$>vV?F7G8Xrtxu<Dn%Kz~uI7P4y4;6JV0
z>h)><s<jagC{vmvXDwU}!a-;15u4YR(c<Xqz)Wa`_KmLH%dIQR7EoC*n)l6<y!59`
zjlpu2nJ}W;MXKOCkZw4f=jLoCf8n}sq{1>ohNQZd>Olo~t6ExYy|~81@S+<96-k~&
z54dr(IdfsL)bAE94Q!Xc#+)t@bH~&bk8Xn!p@!W(a7mJ@8*1m1UxY^3mRH|ch2v^i
z>6SXbLeZ3~rz^IMMskP#s=^lFQ2$ffJYf`1EtjKCawvptP!DgrsCo!L!`F9f?6y4E
zK*849d{&2kqJA=hu*jV{UA#Oa5TbO+_>krz-bg29wY1y^X~n%RVSyP>7dqP0;$KQ;
z&&mw$p3bM8_#FB1<)YnW22E|R1AW@D7~9^B@?W;>2A0bp=!^lPLoK_VnJuTW7OPxW
z>+xSjjbVFuyF-cLOiN0DITFkObQq&VF$+7EUh6nJ#>t=HMhO+QEfy_MCC0CKQ-T5Z
zBn1#*V4!N<r*UeMAf<j*4$?rHkU{+FDvO>*I%^3MvpoSsGLpISqIFU7)7HxBAPb=Z
zVO|bE-lE^BQ9=m!7zX+;kc=WTJcv(Bn>F8j5MRs;X%$TNFLk1@(ksm5J}tS17(yUe
zxYx`E|KHB-@8(9(qqCk8fzJpzFKNdzcD>g)*psLafvZeHg0}q#$L|Zep#)HSXR;|9
zo>uwL=n6+A^~@_f0|FU5lDnO!!HnTkW0Dy(rsmRAKGoX6$!5;rz3^XFv1<kG;4RQ*
zv<$0X8Arm~?;YMP(9~?V+(Fy}G$949Ssh{aDF-|?y(IMw^uU@I)<Cde{Ty7;Clb%p
zygm|-J8o%eX;$n4L$&~weH11pK}#x=S~_`unocVSXVh`=6e-!cV`$cLidA&(RBg5V
z^NJL~9Xjr2xSm86=axg7cE1p<zK>0ke-yruJNx)YW_T4W-6m98mti{!9!HyjxI`yX
z6@zXQa4M3QyCrrTJnjf^hp6Y33<y<dhrY!$kPK;pRRyI)SNJ_E+P~~t^jPlK^Gl@d
z+U+<Ge;xI_8ZV|x39pAWYIegq^w<AEch$+OPzAf)jrEvhK&(8+s2@C}!ed<_<pFjY
z#8ct~3b3LP9s@n#RN<+Bve^{Uz+7FbUZ|4poL25^d82Sfy?mpaU0w5J0NxgsZZMJW
zDl^98L32+Zz<|sHV)w(jBzdoKcNHErYZEI9zV|;xv;WJjZ%Vb!1~sK(zs)`NEt|q|
zeXU6<$k11gSQGk8&jVY}_|ItODGsOyK4#{M5^Dz{#*e5~X{Uq=Sw@fI)r(1u6YtW?
z7xyo<7MirQerKCDUzCGugG_Q&|G`ww+Y>@eqPq}UKT)b?WkK1LfP_>CvX2uUV6|Qu
zevoIPt0GT)(Ut5nWQ%pKa>GdTb$`>-9=gv3>G;$xcIvo%#GJs5(r0WQtc6fpD;+W}
z_;!^hD|i6B+Tws-YU@HcMyqNkmTZ80$0RPPq}2w*qnFGhJNN@|tb~;#d&;G^xd1c^
z*)tE_1G`t<i;k$;)u$RJnB@QZ;fgY_TYkbkr){Ys7+7~12?->b(EEFP-Hz)UxJCSI
zNWSjnbMV@!LS99au9(I5S6Q+=iWWV6w*NeeG(vnwjtExfMY!SMAhDX}Pn2o>cSuWk
zh{}AR-pC&8dPI5OsJ#o?Hst)F{`;jC)<M(VsT7+eUNl~E6tP8=2Vk$I9+t600|?Tl
zD~Px)=w}=%>(2IW$={ui*+S;hpfg`~AONr3#b1ia^$PDAITpN&R;C>(l%7*fl$-?M
z^|0*9cKgLLJWJ@alK~)A#`XWGiv9PSyYRqGLuUXt8%Jdku1*2AlNkazYEA9dqT)2T
zw1&nK!L-XRSz*-a;&1P27uIGG49-DER{8h1fI->b1AQhROb~HF3dkdJEQFLKz2s<<
z-Y`;kS8+~nq2=Agp*yWMU-<S#;X4agcQ`e1Jf`|gwiZ9t53M9t&2^Gs@;LG+h>mB;
zgw`&`S7)ke4UxHlKmsUrUE9W{wB13zJS}|#x%=Dwu)2DC&Dk@(-&HMSUq^RX_nXRH
z6CZWVW7o<Fan>1KTciGwGI`<0MTw6V(Q@{XAhwNtLg`0x8iA={=Y6(~b;FycjPyV5
z;P6y2{rtI5edL0b{U2GUE))Jy=R3w&DyhWBj@VS?sXuG!IaS5i+Tp$F!t-V+5mCEP
zG|&dI$c-JsJ1Nc$-J8ZizojOr%`!(^ib({$ez^-017PUSNXL~XxVpx|Z|;bu^Y4Xn
z*?xi)iWt}4h|nW0&gh!4^N{TJ<1qTX-5HoFkTv9vqKj8;zhMG<auu0X%t$8p{V8wS
z#}Xz0iRMEIp{O1T1lCq!{Kwqbk?c)EYr;&6BDfl02tjQ3Za;JEQ9gyN*ZNOEmuLa3
z&k6T^hB$&hYF;9D$E-i|c!2cQ?G_t7OXzU9Knu%Or`JvBd@}-ovgB@1axgBb>x61)
zM3ZX1AoWx$Hx*C<NjomcaQ0tt;wYSx40o`(oPY+sJc5Z~BrM=dQH%QMnfDAXq2u08
ziEZlcPYL7oNnVn7%(rD)V;XG@+9`>%^2g;zEnx4O<X6l?R82u>!H#syLqwtd<v1?)
z6^kqY?%qO`4MtWE+3lu;l_EL3gQ$K-QVhf%XRa|(DJ)P-ZGeD=rSGa`3Sslp$wrex
z@9L|Kk1e3+`6^nT$)*!>-??eqIJPMrq?zg`rmz9@%WR7-&UnvSv<QolN;=Z|`?G%V
zd{hfzIUap}h(>rO0J;MHV-|%)sY>}-k9Et-vF`om_R4?w`I~La=VoV{+b=254(nhy
zz2TU*timDDSc*5=kj@1Ma#XmAZ8ok!v`G9=1?fNBe;m(R%Ig$SZFM%$${sl*xZ8Z8
z{l_Bd>`~%s|LA0;m)B5@8!LlxP+Ry-k7A!`U(0LEg#GJ3+}|;ncKiqTPXnx`i*T|W
znDd4IiK=sKOF5ab#JteOg)gztQw&ir%z-8@Kbk<|ZWvHp>5mIvXcT-F<$g|dHnsAh
z79mOdlNF4*v)cay{3E2ySy$rK7z?j9B^Nb3Gks)6LCsWYB}sGovnNR`yj<4iUt7h(
zM-tPyPMfIFpt>4_iBD7}T2xPNXn$CYe!rg1o}d@9YF$%@?^q~Jh{>bqP_lu{H||oo
zA*G4mlvIXVp}I<%wGrCstyURahR7(HwV|K3vexhESuistl5-R?wjNZ19_lNK(7h2o
zDJvxaDky)ze`={I*pbN2a@AZoZf+c!*w2mHN8LfP`GlFo2+e@q45cib=t`Y&8tC5I
zO%gpR3(Z1UYWRhNkv?%O`SeRkBvD23mjl`m{jtuf?ahywroB${Y2ODFr_p|&te%#?
z^S<DZ)Vvgsj$7L3vt$&kY_$7Cz)g1T)MMh<XN*mRhMa{G`$KvGR;_ED)hmdOd7vo?
z0p_8UnQ@bpx&EDF*T`?t)%B*#`?QdxxKcBWBPYf6Ec=e3uO+I{<Y6N|Y@_ol99FU|
zpfga(W+1Z0dk;JeDu;7;di5HX0LzB)D0TPd*6ZcQi!*@ig~_S=Ia<?|wL;^cHH)TA
z2?8<PBtFY6+;JZQnNyOvba**hw+i%)Dl(Sg#JdMwg2Q#I9}Pl(`WivxOzKM>pz-GA
zb4V4N{J|Ehrz0BV1-R6fQkC>0BgCD~p@bgmb5z0|HSuasbXzotHa(MwrCn(;6g*L|
zfC6x_UXyyFP~NpRGz9#_0$iOQOWo>`0>Eg2%B%;y2u~+U^VP+@U?)(M8I=M{vVth<
z<-d(gH6+D;O?|Kk)Ws4+ITQFrk|9u<vna7C{J1H~Yv2@8ovX4BP4a+~YzwAkf>c2G
zmc}M@@f(L&q;@Mqo?um8F2h0-V(&q5?pLBfAPoTYG4F5VScOS(b43srM?eR}8%a+Y
zQIu>c;SNI`7LwZ?<N>d%y0=&MVEXgd0zS&~o|r2O{BMxO8fjti%OT#_#|T<1+~+^m
zVDMINulWUprIP!eJ0<vMJi2U6&2%k)(hP}RaNo_<G8N0fe=|-(M8hm5Osag7J<9e)
zaDgeU|EP$?^u+I;u1DSCpZ)n8KESdyjeX`9QHf<9oFlVV^=bOdN^}p?K*|KaVO4uA
zV|k|Qz6|_CcE=fm*VBAQ(i7w^O7$daDfqLB<3sdW53|a596h)j;EUP`eer40VX;D=
z{n|j*#-ZJ@FVUO4wfs8lZ}FxiPWz6dJ;f3QPUo~3H2_uTRl+atczIx0fFMk=p>bLA
z*<G_;>B^cs*%Zn4(fLuw(ZRd$ejh%I__2_ou!)z4oMdMp85N2*Gwn?q&T|bpkFzrH
zVx3W<LHRb|haldD`|Ye(*?Gwt`-qD+woxVeV@dU4ezFw&J5(qvDAex0#@p1ddN!%m
zY&EENRYm?c_`_P8#a<oL%%YYFg(I^byVNA=#W;c_rH!bgrEs_H0@qmMuX|nQ{CR$E
z+$jZf5h*MJ*@-Y=QnQxEc0KwU+ZUAv$ZojtJ<-<btNa(6-)(j2Mi7fsG^J;%6UN!R
zPmkG!#4D)atlBRdfqCuR+(%1RjCzHquEN(dqk64#?-3ReKq&HZP11`Eg+ZnZgQl?9
zas<9`Sv6(|W0Z*MnW)l_?uF2GT941K(Gd{~Z6v?2TVq+j-k&~1`^zYL3{{~2ma=14
zC}qMeSO3fqD*1~&W7t<Nf^E)9Wh~yMC4;{phLqnE;kyR9u&a;SRLG{}fHAIIz(nGo
ze#MBB3?i2l4yTSQ4;0iFcU5L;)wQ=#VpG{Y;3=WN$9qrF*CzNVa+W^Qo^pr9&w|c0
zKkI)_j|YCSRFTE{V2FX%2=|3|@Rctrz*7sqo)0pU0p$w;yW3~`LIsDKY}64%d`<~z
zVRoR~S!CZbm6#}K;YCL!t53v*R|hWMXuxmGFC#;RI6_rVFIeuB?60<9RHN<B$x%Ik
zXYI^;q`QF3tco&g6?nwxn0e$&fbVTMH@4|?@LEQN7AOcu8H}Fc@Bb#iu!mQXY>!X^
zo(Y---H+*lP$l8CA~4-+-FobsY@*3eJ2<P6BHd$Y$_Bj2;yY+;g4#hbcWV(J{06s1
z?fNiM)G_JUgCX1$YTRUZ-2e^66Dd5=q86SLc|)8AdZT|8k-G+_8keId4EGC4M4M=h
zzXq00NZs=RpSTkh*X8eNVu!e-N{Wd!Kda#~9gU51$N-4WC0!S&$I8-7jWAq}o{m^L
z=r7@yDWLbNZQ`rGHCA)MaaQ;EI2GIYj-6)saqa|L&TPiA`S0x5{`}#CQ9@e7t)rj@
zjcK;^@yqncX`iakqQ>n2pofzi(*6tArLh72NZLUMW(&55wQ0ReR=^GBLz>)?I6OUU
zed1;h1s*$&>8fb-g}ePAQjfEL-}Xkk$@Vz&1T;dFz*O&S!;bAI1Vk|I*1tpFOm1cl
zb#y$4H4HrK{=OYwC2?ksSl5urUOmnvNXT*d^{5t$@PxG4L(^dY`q$oGd2V$aQan6q
z6a<VQXh@BpLQk<>MyYUye%;+2{U+O*Oc=JoOIL$VPzwJ^>kPQ0O&|^%SO?X)tW3C-
zPj2iBiZm_o@+UfQ@XlunP#hmae%h%heJh5UlOo`X<}^-Pfa~SJl0Z%jo=|hBabuw_
z$<2VHl@;#a9o+A23_a&V!k#Tb)gE$&b<hVr#F=9c-#-_?b(x|2NOS)GoRGAFzK}fz
zBQOah{egPX&;XVl1|Hq@U3C-Cqs<OCkD+JG_slPS&W5R+y8A7ws6aVB7JpaLHYP4M
z08QsZ=)6FWfHQ2Tddl58qg}|IC{kYvN(j#%1^kibJ0P_{CNj3rN)ZT-*&Z0eN(E?R
zAqo7i#kv4qB+qB-9~|g#qOfrT<U3cPFBkhCTjX$*&=Z9aT#ewZ8?W1|-<7HylFeZi
zjQ1$IEqZ6-faU#G@$LZ8%qSB*xmKr#5cm0FTFJcUL>wJ%4H;N<tO}~<@-hO52*VVe
zBi`$U9=eCwMFI$~WJdt_6M70oDX%hhA<+9*BuikMt{I*aupYfrZy=vxDK`aBKW5V5
zWe!lwbskWQ6zV$llV?4%e>&qtj@e|=*uj`pb$o+fYSAQ$p)K^$<RlIUK5DQUCDKen
z8mqVreW`{(m|9HCCq9g!f?ZT#fxs4+*#=cCiE1msg>6l;53s*<+Akc|W~(I*N&;X|
ztQx$1<JY4|Qq~R1Tz31U60%@iZe#E(%Lm%t3p*B1&DSQ+eG^W}X?ysbT=JN6rMhZE
zt--9zDBNe(6`S4Vof&+f^(CKlUP4C!@EzVzwVZ{?te@QY<QGl~U{`t7Y)m6OOpp&@
z&d5z!&VSMM0tvUq+;v!wxOKo$-hk<PB`P_bh>HP9xuc#eI-P-aAX-4P%c4u)`OF9_
z3g`ruyb8bKv#apki`{`V+J93hUhlGHRJZWM2&>1pabJWbD!p9@Ue(H?M!sVy+!lUn
z+zwtD)&bu7LjB!>!#17&DN(b9V+9!Z$d8j-&+r7DA3?Iy;+OwsCk?h{ag8Kva92ja
z#42JvK{CLuy%sKwx+;F44i{+HA{ehqPoPB#+@iN(uifZ9Nq>**g3ZgdXq};HPc3%>
z=j&JV<4Xpn6>?)X_WR{Ny_@P&-7%mPn%0iwC;^uI2B8G^u8@7Q8hcIL@nXFumI8RI
z{zj4onhq4BX;<0KC+T2XL2S#3qV{?mC-9$!fF>FEK9v|^_NM&9F4*U#=gQRvUG&ap
z=C3c<HItM{v*oF%ud|4q5x3&qq~V);U%DRjzn@bQ-@CI+WKnJTE8Tt%;Wo!E*zeCS
zDh^#?Q+;_9$fOX~*q<)Ifb{9x*q>{FIU&U4cUE~ky4_=ezQ(!x06>;}aGTPHQ&72}
zTrNY(+HA8oRO<6>!Hg;;PgEmTAT|7?$PoH@k!hCTIsW!vD5}{ga1q9B4kQs4wyy)H
zyd$J>T$C|Htv*Vf?bBUfJH%nC*uC^q*kB0s%@1?mZ}YkFePuREeuE}6d6Q+wbz@?G
zT8R9_lBWFwlD6{)4`zZ6`+1L_-PZ>%MBl!5774B`-$=hxn<TnrcO?TYk-xMf{5ZH|
z35Ivo_~o%@t{aMVYWFl{uk)OE5vu(|#k3uGO&6%UAd$P|g{%CL9tl#qt}RIZ8r&;J
z_tvuy2iW}9MnqYpH%7$i^EO~^wL~*4UR&T}C#r@8-D-n|G!8^H4${FSY0Qll3~FOp
z4ui4U4uHD199@5P+LeF%BxiYPV&wF6)^ZK;GC?KjQ|zMW5qc-*DaaJCPtd|-i~JOW
zO|S+cL}i-@p={o(hQ&8)?v9*dYqmS_X&p82Ae<k{8^##K%}*qL%Y*aqD-Y=dlZWyz
z>8FEfZ$~X52hR8r-+y1xb0<YCQn6F(*uaZ@L-ragX;7-wv{36=+o&NYBY_-vOK;81
zmZRJb5&ImS`*65EesRA3v+U8q{V{j{>68=;ce7~21&?9&%K_8Z6^;IfYRcRF{3(1V
zeDK{lVHgtw3v|H6Ga670`+WQZJ3cigHHYyrx~MO_+RA=DE8DR5`U<QXlHDhoM$BHU
z&a@cd`^8Ajl^tr^HiF0}_mG=Ok{PdM@4nclk8_0j;)a0Z?RX1*;q#<Q8j}639RO__
zmjTAPnn0&=mvX~fR4FTdpCa}s=?0Pi7K)o&rej`S^Q>ZCQtC|;`BTi+mnHuRA=)u^
zB(a{~T>i|9j%)0f>x+`>j$i5BHO#zdqwRTHOziQ1WbC+G^u3;k7g0B~?DKlS1f6C=
zb<q$j8yXW<S)|gj_$1RD(xP84Y~F2GzT0orm{FQU<_MNggNV;0XRp)yKwphcYi+08
zD~C?_zEb>EWxPa@P)5=;Er6HptIG47<4!|8M=LY!aEwV<0zTET2E@_1R-$A2K~Vv)
zBt%m|9@E$qzdvEoMLp(`#B?Y*@%o_b>I|?+e;)el^$=cMCfr*eO?X<-y^+BAtdXX5
zAeC9ync?w#p@BJ0qm?lN40!mDD-&O2Z0q#2OOvfDX<HGTP2`)M{qGOyHl^=jLboY-
zy^Bl&YM(*^2ASEER-ZEGQ;lIunVf5hLo}qKke^=4PB8_oKt7VKIC7}^-|w|Ih^ZX7
zqph!ZT+ysM7M-!IfK{UeInqg=FYZS2)#Lu(BMnZj0TaI?xh7A4r5N*AiK=qjr%X5+
zn#{iXt!0SR20KOJOsl0xMX-C8N~F&>YElwS!sdBbmHM3EcDRTwk5Go>`^a?}VrQaP
zmt&T8mgv7SG-|mk@`1<0rpGicPu=1O-^=5T;oeg}53{hvm!X9lkF1aoz~DB-Po}nt
z+&{!GXm!}$g5VpL(=}U!D){%GUc-bdc8i=QS8@-Knw<|Mi5KlHLU;AyF(4ku=FMT~
z5C^%$+c2m_@AL;(C5BvjoSGZTD+C-T&=lPz#)Q>~3j3f%y@6xAD~3Q~-LwDd{+|uI
z<nj1%zMo5RZS(NEjYR#s!qg@Lt3YJy_bm=CNbvk*<nk<;<o!bh);C6$^|%J3hR_=L
zAJa#*>wgBC-q6A9i)?<v=Wj##_NuxCkb_4<&IYKu=?FsY;5EW*O{EWBp+yNE>(cH6
zr(`ASu}ELkY~&(&1C$bbl({Ve4$1rilPRaYJY&u42J17XhLOr<V0^96Q7VH`<1)$P
z_6GMZS;v3^9G2XunQFOCUHOTePv|}mBlLhP@5xyngx@RFd;zXZH<pX?!|Lrds`%?)
z3z^u9Bu}^bmLGV7y^B<=zV3k~MM8s*|KryozOn{SRR+0Eprc#{R7ugsy8Qn*T~6jv
z84Za^1;^jm6F>&K602|S5cXDmg`~Su*PdA%gBHqg`flDL6d5<ZQYVC%uUu0P=FM5a
zR0#|0Ehv>-Eo%S2H77MQ|36k8vuKw`s_1oH$V#;JRB|4tXbHsH3p=sc50lQJM7kH@
zH`;wcV7y-)J~<EGC6Cf?V);rKa+0#6g}S37;Q?ocPDE-;X<(2JvxIp!=SH4;2-8&y
zNs&#e)8!28%hJe*D&<aCW<9j0b}BUbev-KSTi}lXR6CkqMLH;484MB>4k5Ic+ZnW-
znZcgye?k!B@v=w{*3rA|M|JbTpo+!}7NQz1FXiR^zbAj*s%YMe;#y`>V@E=ZysUR@
zWP<XVMWz3t>P00re?^o`{)eh#hrn<iTzAmgad?fS6~3vr@}z)A<iW7RazMVj%fZeC
z@FAZqJ^tU06@BLrVj5Vl($!pn+5=@9LQlJkMD2flb~yF-l#QiYx2h@fyn_Q08@b}z
zY}HK;?rh*aVzM6W)omQa>64iEZfoCQ=-kTG%Gd_lG3esk)={E>eei@d^g$k<j!rG-
zKT%^t!|@OH>%#x1jO7wA-~L-5%n>>NQV-EOF7XfH0%vNVPze4j&LGohA4zy0!%rbB
zV|#)Ot9?>ovi*YcnPd<@TWYNkz8Y4&r1`}XGZFMN5J;c%Uh@iX^GO7TCfUL;T#=%{
zW`j%<LQ6YFjQx6K0W=MnJFbfeKdTDH*D=XhzCh=rD4qM=!z-*k&H>tQerym-X|dKa
zxruwVwvgf<m*2wu;vgP_UID}<xGaI>0{I_SK9+XjQ;2H$5M7kd)lSC$1;uHRN?}f~
zyI_Y7e5GSg2;r#oggl=!1u(m$$%#{yrQ;|eVWteqN~j9Ujdw0o%*zF(Wh#@YB0j>V
zoX0TFK4NwMP~;Pi_Ri);KzZ)Dh=_a4OH+#kfLEVb$UY2Kvk%Sab3}$I%Z8=B8@Ng`
zwU&q%P&)cZMU@5%r53#0{xjX>kV^&M>SuBj<;~3@T3AlI=V75jACw~hm$&7zovARy
zv>eePxgP`0S(HZ)##L4v6&G)`SW%%qK}j>%uy9v?Y>)Js{rzTh=Q1>5-ue~m#gih}
zP8`fBH?#Fpe5y1_{st;arF+6u3$Q=TdCT;LzEAmx%ZjTPRu}`Z@*9P3Xr9gF#7jMK
z<Ucg^rvb^yO>3?e<e(oVR0JOgsM#<e=?gWcg_WR41@mm6J$Oj4EBLk3&@8!>C!?Ce
z<6rpjeH)Yr!ie3^adwW{sxD2rD!b}NiHY%Un8V9y^V5iq@ptG?A|Q*DMZm%*Q`qrH
z(D(9KAhx^6zi2HIOvjHB0$i&|T>%<9(Kj9qssn28CG2Us(Y{f$Am^~ORd`lofM5C9
zBWcL)EfM_>{H~5AGp}-Lkw6r>0zY^WY43vu`kdM<US@y*`=X&7yj33*0+g|C`J6nN
zl93EpGvbTTaX6;Nd(KHhTGsr71&I)1SMNC_iDf5z+|)bEg%S#R3DjfB0OrH=JY#W4
z6Gf*UE3#z0Jw7K7Gl0Qm6Aj=&M~0XrICw0$I6U{ps0-ZH^UkTI*pEuk1Ktt;UL)T4
zeq#8%yT1t;ef@3K@x9aA?LrIGM%3T;K~A@j<!fm`<MM3YF5YDR^O4dzvKVC(_k@L8
zz_m)2x9lAIq#XZI{19xpp&)B)&+oKejpLx5@S5XHNsZh2KV7=reh2_S&uT6)afCVG
zDs*s~AW@Kbxr%m4yTINH3T^8)@2Gjg2pF}*up;;$x}Up9ztT(pAG&XX)+o`7A^@0-
zC4Ptdm8FlUHP^T474$hf<#qT+u(LY{E7bJOl|aT<beo-Wc4J84N>XWEbux@sV`FPr
zt|O<^<%)fgd&ZsGs^=Wx@DFrGkQti<*!63Lxs@e*QNqB6dg{|vXhUYF#GFph;K_~Y
zz?MryiYys9j7N(=SRA-OCUQza<mDekf_NyI#>eXCX~4$nnz*sf(1s?cq}{{@<PpvN
z_T6P?=BB8oVUtC*h$Hh?G>`OGX=&2n!iBs~W$Ue%g#_{^exQU~LRen=fK-3IE;1(J
zKxUNp8?|!$IHlWQmG4Yid)VTr?W=e_X^*#c?N>;9?T=^;_&=g`yZuL~09|{47S%RM
zOaRn{Q7r=_bUuR;nIA`5o%r9W5_oa972Ys&Z`11)B}aXN?dsgSopN%Zi6mQb!yIQu
ze8P6wJ~*9!zV}exAZ1<C3CoBRJeIIADYWsPTPxD)b1mR?mM0SpRYS<X+>puQZKc@y
zZ(ma$^yWI<3)TnB=PK>g%6V5;{vkb%2lU7H?~pIV>T<JA`U9~|mwO=mN9rplQ8b=`
zDYSVou30!Y_+e7J2UphU@^*8xlv=!s{z%IUKhm;DW-`D?k82|GpuTH!jPgWHnAPb#
zF+EyRyNjW5{MqL2uJS-AkL!=Mc+-!p{4>VN?-dHP0799zj5P|jt4G4+H}{yYZx~fL
zudFW6nSj!!khszr*rQ16;aFvyjklAK`uuqR<QbcIWRSUZwcKgdW%~|wiH$kd(p?$S
z)lhCh`}W!1_T$#|BCRDLwdqbpQ^T4e;SJaLQ5t!(@<}^G&*?;Mw2YaJBYe@AO6;dw
zMszQcTaSy%6*EaT*&T6KwH6K#fx+Y7A9D9A;hDDOjF5g;CGfYopKDsOT$)BSu_}Wt
z#y{Kvcms+SDq{AG{Go){J0}+;?(ZL-T77D3YSW%0;tta>%nYlCIt6Z6`Swkrl?QqJ
zwZjg+d2sSWW#ge)Nt9W#p0UL@nQ0Aay?H<hniDk}%&z29e3QxG130wW1eh$KlmE{e
z-*5gy^X^DY@+*6apayf2VZUIk!r@1=u`U0^r21wP6StR0Xm!>iKzu_2sWA$^iu}B>
zNw<@DJZ-3r*wR*@u(Qz=rH3TQa1ALQcRX6F#O9ZTB!0BAwzY$op#3t|a#<+8VAQ2Q
zZsEux8z0Zzs+%t&!ku}#J-o+zRrt<(L5MyZ7Gd6gO-M+Bo%dk$@u*{#h><bScXLU~
zt7tFhfa9!XLTyo`Hx<pJ5(4Hu@kCxd&G*j9j1SI0txw8(M1b2>_v8nAsWL_Vkz8h7
zoYOGljd_RBU)8nye=T4E7wL^*SJ{a{WN?ifuN13(VJaNZ7@VrSUk)5*)Jy_wp+C|l
z$BQ`#86g}twm8KS^8&7pLKm2WaHKsYESAUfjxM4oFSm7b;O8lAhUSeKxIKZu-pfKY
zX$moJqbO+3udj~^bi=4!)WZkZOh<}(A}Z9?b(X6j6kjtDDD%de`pY4`qy<LZu7w?D
z2XjVAJ5)RqMff2%fIqyovfe?OFFf@!SUEjV#|o#SGx~r4ws(iRZQ0B|_VWFSsiU;1
z;i0hxQBb8c`okKDc})yVc~hkjlu3`%KOEWkh|HBlT(~b;l@_Zu`W(1UdQD7m>iZeI
z-x@$&UUZwZ96Kfd=-74Ah|D(m>%nC!i9uj2^c?v1aFHd6|1L=)cX5N?(uVLUvC%!5
zrTMN0nt^0dg2DqAv<>eW=$Sg${-y?qG}r64kO0pBGGhF9UP$tcuOif&#i6nq(S^Y{
z#%O~1aT5FM9;hKJfEITu3^*B$ZplBmq}J_i7k=0%76wR21^DGYJj?bg;yTv$B+~OK
zoHYONtRr2?rhi=Npb8ESHT|}}u%dXG9FXi$aCQe`ik0Gd^}7dU$e*KGI2Qo_|EZM1
z16tf3(*m`|2n&-_?yp?X`#UA8kF%0|G=DhCH;hWwB^J#=@?Cm^#8617?Kvsc9|8n1
z1`vAXLD$c<9p{0PQgO_0vVJlY16B_E90d@}+jr7o3qFZi?~4{+?)e#3S-tSr!e1<z
zLAYx>q0}quwR6K5Fu<c`j_IbcwzDk+Q5(*9i#ik6px44kgBWS<s|WQ9<1Nm&55jd5
z{B$a#d+u@i=FWxR1HWg|1ACP`hBd)s#!MU)6tvk|&dwn*rpTfwfRd;xfbiy3fmI9Y
z&b+z~uDOewK>k|%g2iboXay-z)B?XZO$RR?0u1gcPaYZ*h)5ZMWkv{3n5r{uv%#|e
zAjQFhZK;Q7)grV!<mLJD3n;pVn0feMqL<1#vZ6e+k`){2MiI!JLTPKv@Y`bi<wkNH
z=>|9{<5$xZ6ru~<Z`0t0|9HjQRkCfhyHq;ig>v{OuJHgnM$Rt(fOwKVCW?Yc?eRK@
zx*yzbeyx}Jzk%y|Vg8mVP{WbcQjY=C*hp`*>La_>x)FGyb|UK9TaB<noqBl_R~Irl
z@x7yNfj^j@qs;(wESruj^?%!CD>&eh?8f;0O$&s2GnK3L!~<p~#6^wHvBMK?FJWMC
z^oMl=B9<Y4fMJe=k?ifne_g;WmiF!jLAsZg7O<^^ybKAM<3kT>?DLnDRH}*r9WD#q
z8Qn7UuokF6E#yhb(6n+tNoyIl%wq6p%y?VEBed2gxAZ*o{5N)OHQhqC*Q7dP>mnVx
zpV#5hL__)4YF)eeSz+4=rg=@es3pk(syXVriQSIA9HM+&QcKdTCnV8n&e(-rKupEO
zUs`)rS8J3-+5ip=?;U~JU$o5Z91B06Z=d3Lz$zFH&5b_=qJ{L<c+xP0ez><t0bfR3
zouDbQiXk#BZ?0MOKquf@k?_?di;N@9cz)Ll*(SSc5AQ$;HX(hScw)EE$2Hsb`(X58
zShQuMHNr;_$^t=j#pSY#0wUo1=RgrQVO=*v61hvtcn$;(;d{6PP3svz^y~R}K@-aB
zdJ>)BY8WT;3{AaNG&Wr66E-%G&n#j^W&(+nPPuzTZ3m+@_-QyChrkz5kTd?>--o;S
zI3NWSIaw>hao$cTA3*+SKs|B|!Kfb)Oo$ZqN-5p+GSEF%J6;%rZ?17%w#)56{f-R2
zpRSOnx<K#r;Gv%!BU6IeCQG*JallJtqJM?$P2lT_>aaUbc*N^#?BA~A)@bCTN!K+D
zK$cMafT9Brx($|eBJ11Vup*kYz}Mvwcvj@opOZKq*ua!rOw09d5Gt;N1jfM{Z2qq3
zPqA{72YE=!pq<b|O<6HcTIy&ha0pWO-&~gYG+kUlOlPlX1Iex*)#$b|ID$4KLvaIZ
znSzp>|CL)&@3s3Y(tQrfpf*s8t^$t5;OyKhL&V{#N%9do?*<vH!E7KgF_>Q09^k%u
zZk21PG3XuPFBNV+rs1+4cMSa4s?^HTvtpnz?YxQAWWVCz=sT^u3@}Kwuj_!UP}-&x
ze?_f|EBV8E+4pa_1|iJ^Y0NFfE7u2n-fT$cYny36C40k68z^o8^gV6%bzj!_Uw`Mp
z`Tz&*Jbx?cW!*Ik+Bq!`qRPATzj5a+>Ad6#0SWPuljG&oQM}v6CZz!hy};kT;X1m9
z$f|L6hpbAeL+i-B-Sh^KJh?b0Egn-i*t#*w5H<OzzU<*sCZM%WTc?e~Y%=)tB*1W@
zOI3cCD-f?yi3@7Z)GIbR@GrV5qf4u}d&w)v+xzUBUnuN}n8IkH-?pB&97^m-CInwZ
zWI#c(#x!NX3y^G}^3FR<zMw<%H0C=(@!bB`Y8YH820+cev;!7xf<FaP>tpHt&d|}+
zHb|@M%f>$s-Y~}mi#(N=BpA-xa#z)i{}XGfNL{t^8N_>76$2vvHr^O*ZF$GokR~r>
zbLPV#7N?8YzfD$dz0L>yUf^{NP4`Rcl_)E!@|5^ACmkPa6XM$P#y-j3<d{3!`+GNz
zf2L4-o)UP9tKj8mH*{B3KiHUUkK52FaSQDmX{IfxbK>B;&$;?txaauTBd%L}SQzFp
zJ^Vu_@Xrn9nRqEz|0?7D7j&`TD3}dLHWdGC+{OdHteJ4Vjb--!ZLzNO$U$j*Y;IgK
zIBhSh$OCX*-tM(56vQ&u)>0c#q$#JMZH=`OG|wcs{o1WXx>N>m60u(P16^GGS80Ua
z%qV}C8)ziF9GTK&VWom?5V4EfP|Kx7C(}`>_^9hp4sYc2|M2w=Fp|A-w{E+qZQDI<
z+qP}@wC!ozwr$(CZQHhP&p+oo=Oj1xCY7D4H<i@RPG#r)t-aQ>c5Q8I8p^~fQuf%)
z*XLKofbMU~Wz><kbnW+5lA2^ay+;CUSTL5PUj3rgHGbjU3Gl7$u$t{&UtZ{Gm{7pu
zsirLWZd%O)trr8a)GHfQNH3B5^TF(O3MV*N1~`D|QW2#~j*7zT=W5SI<-|pzZ^{Da
zH$1{b^nuepM-cbL;NZ0W9myFmnh~K~ZuG@0Pty70WDw8Y&#8u7&s07=-4XvlC^Zt#
zdvJjWE*gBWd}F@9l}&nR4X^)uvi~RIN$UGdUdwR6?sGhB45@!Tinoa!7ji(9rF&Fu
z$=b_HtA7(tb;jfcIsJvIE|qSIK~*&W=Y9OjnF)^O^jmPnSgiN6mHdcf_VT^7`?W~q
zDa%&4^><{Y&Irqu6@pqilkZLEN(Rtcdcx{3?$t>V<_2J%d5Ss-Sv&7DtR^E%2I4(z
zd`Sq9c|tJD>7g8ExvHjF4eEqfww!Eku@y=2Pi$|~wNc@OD1yv1@3c6}^e^9Ws=^Ao
zaN(3SFw^S`!jn-C9CwDbbw?DbdRnpR;7jw3qozz&y)ZEZ&&-}&vHxys;FVdjEkr(R
zVd3*_zJu;tRi6Dw!??JdrM2a8`262E;lIfy>97j_Hv!|G>Jzb-p>DH4IpeNor~(Dz
zvzqXG;XnQbHVMJRXXK?MN5#FZJ6-gh)u))gWoI3)T+vT(P(Vk07ms(0az`FpE3@cS
znD(~3RaNm^*&SE9$(P2|?oGLtb{9gz$%tQ2%6Pl;dEtj)kr_04!d5^*0I~m{5GYJe
zd_%`BDZBshJUd>4j)NPSBF<ots;G3|UEBzlAaY3OJj|Jrrrg9p&#vt6ttzdSC`Iln
zdYH(f`!KLs&7D@>@rxGjWX>sz+_5H4zl}lCaASS-)2l)7ySaR4kSQa0l*v22MAa8-
zPVh2Hvs~OG1jqdMKx<%*!3hop_dhXE@pmgKOiKfV69PT>+<Q*nrX&C0kMS!LRdu=W
z(08hH+-4zD)@!nHHcO-38D-zr&5biykYLU12TI{sHW~J}-9V70l2&OLOtEn2RBT}j
z7lrHvuaT=;sLUZvqi(EGc4<%f*-?5eW~p)CR>10hudL6(P_iOJ;5PasAi}?6rJy1b
za&;^-nFO|YyWZsVLs0|Bq&2rh;Zxas;2)Mk-lXvVNPPk)gE5JLT?-d-xoY<1&2Uw(
z?uDv3wiVo5<*rmJ)ma7tlg@t#r;Zk&B%?2}=ww^}Zz4q$oO6Xz1;bDWK4o0ZaY5+Y
zPf=h(n!F9&|6Ar`aVhUKcXtsHi={D;WDKaPPRxa5{zqQ!6YUbQllm9KB?A3~?To9Z
z>LkVr77b`@<=3Mn5-TE>nCkDqNBGoLC@`uUfzqgvJN(RHWHsXaa2o*Dc3E;Ve~Ni_
zONo_SgH8q26+oPM<cum3f{si`C#ODZYJO6G8#mqMlBpgu`n5UL^-hD1RBMNXXeR%4
z#TmHemM%q3T}CRNfYic-pjg-<3?$5GC`{z&L#rqN;Ur9k65889()(9NgtyLDoUNzW
z5EWG7O(I}6|Bt&Y(`Vc!QAn<@tpvurrJB6Mk0STNAVA?Chb@EQeGZp!Ld;FHfK8^{
zrgeH;%{Zpj=P<wk$Whp^^DKa@y@eNFY{%4!Kb$a1s>5KxbcT@HPo(%bSD~tOxd@sC
z@0fJ8v;au;=X#a>2m&r1T=L>aboqbBOusuBNlFla5z4m;xO2A;0|icz7UFePCX4N2
zv<}Sksl+`@@Jd+>LQWdB3#`7!yd}IxFw<y;<Dt&#zsl6(g;L?plxsEqjBRV~BQ{bB
z$}21D{|a*-N|dfr)c7?_HChmG{pDIbnnlnQQ1V_rl<+5gm~E3*qv+oA$G#Y2fp)Qj
z{?ESn^<!Ujg_tcf8H0~+9Z-DPj$>S6PW{imNa|okLHR%S#f5Fmgg+b_5=ia#4QVJI
z8-~}0FPu0CIockd>E^QPvLxok&nX`@aD}z6px3V(=IlF>p(OOpDy5xAp6do?Bky)8
zo}uKmJ_83OO@@%>KOL>`9FaXzRxkOu8!t!^=9K!^+2w!h8e50EB3^Z{SAYzgM#n06
zzBId}H=jhc44N#``Tw^<ls-6dG3#4ddfU7dLHH(pDB+*5me)R&fOf<a!g!-|N1>AN
zBM+gF9#i?gR2c-C>y)T2Tr*p(PE!xz)uO~pDGI1E*dqiv%x$PvfF{>$tZ0JJaQO@l
z!o*W$1RyX|r|OTI0I);lrP$ZB2QPliJaKhIDVGsiF?*#@?8cScaQWV1R2YN<et<A}
zX8+c8O<`Y2!lhUIM{q!<He0b>YaS_yjx*VasR}|MVQ;5o-GUxIHk=C{<|fKL;7wP$
zFH<i~F=csIunbc*h5Dxh@mO0IxLk6bCK&w?8&0Zl3>rj_T!KlRHn$2amal{(8;SoY
zS<!R{s0AgE{vRm_`$V1hM+##8Ck3_8HbVVKL4E(Eptbq`k%AKa-0)xvz)&g67<Yis
zd6`P4EIG@3ZjuEEvXAKioCwM+32zkNs_9l~)+k<&hGpjLb*}nU$>f<a%MLpP3fn8L
z{mOHAw&|(%l?gUZYYJMo&#oArZ~{Hjlq)IbRX!(yyPtpxx$P=tlN@EQ-D?9$DojDk
z$M9=W%6A!Nls#3Vd-E?dvd`JSVIxAQq#kU#PNasAi7u>OylMWh>(xC|&5))W)4tc!
zUSOP9>(XyZqqS55U<tJFZ_qjWr6bz+vzvDaQf_+!mfml7dlVj09ldGv3&~&HFXWhk
z<lI>eep287tAWOsuKbYtTN97<+2dK;Owyp!#*+oDKNp~1<rHRB5JssgX$h)v6>nJ!
zDEC4_tc&iLb*F(^ti1gHHgr2Ym31%_lbkhfvuKuWbTVuLb&$mFHzP^U5s48Jj;4%3
znXP-&%-KJwXhnPmfmCA7mx*h*L9G&VROJ<Ua@(HAk*XtZ$5b$1gH@;X&|mx-o+1{m
zQfTg;Qy7Nz{<OC^$BJtoYEhBCcnNKHH|<g$Tx6kb{>A|PdlRd=o?)@F;i3(_iUsmj
zawnYjO1q;1Yn(;vN|?p{YCCuSjf%qfP0kjLXo$~SZ!sppEgk=R{lITn1+R~aqx}vp
z3ih*@AG=>sMx>YPdE4ZsOmQ2%Nl~Tl3Vlc$mbKUdpyN3(3$6=9e!_&b%4Uh8&0A&d
zrtFbDgC-H3AYG^o0t0)48SqI~!%2bKf4*L&()ynYB-*88B3#+BiTYGrZ)@LMj56Yu
zQu7?ND8kt!@4*D1u{Ry9%728;BQMiEBksZgg?M%L$`aY03!;~X;HN=-VcBk%Lc$E4
zLd)DTk%2j(umLi>s^o8{v#95vzG!hvs<$1*+FJ$%Kzk$}Nc9eQlQm$eVwF`iUp@(g
z>e~DL14c+c@&hL9w7b^jwN8j7W#O^V(S7oN7UD>x)ScI;MbBAAmiG@-`iB4(V0*8G
zT5wJ?y2z>8Fud_@>$_ZV0yI8$+HDi_a|hi9`TMTXrf%CK53G6B&BQ;~=5GR(r6CA{
zyd)5QJf^LtT#F23)QP;?t_VNv_abOKZ%|$Y(Gr<Lx)aJU1J76HLB)d_!~)KmuVC!R
z2^B<%2%tUa79;h!A0Cp{%4ohxO5nPrf{d_3Ui|}<Qi2_yE61(@Qu42lI_yapOusp&
zvl{P}Ken%#>A=PoW7dLlsJUzl9$C83h^pYU_ybGhp5{-z3U+1*D>gaV3)>G!gKg)y
zhrPkZFc3>5-AEcb6%=1C@(}D{UZV=*j8d`IjEvxNdBF`en8q&0%6WcxP8{K%Z?Y^(
z`&sd_Q(>Q+YfY)V?r|&w$|4kpE+0G2KbuE}U5D@dD++T(=Q%GOtOj~S%^x}K7TquM
zo_f1L>{Io$Rkstmigj#rk8#N-Y(dRGkcW=}bCXnqPz$*#IKSy9E4zIA-s6EFR2!J5
z!}3bC$WW!t<rz!mFf)d0Da^=v3AZk7CS)W6$l^<FaYN28LPm0E>`~t3qqi%$=L*!b
zSEZRpA<S7*MqU{b`95;z03~Pomg0_;%_}h-16z#s>ATYAvm}m+T#+9rpac!Yp9+2<
zT|6vcK6ks<XSr`zZgSVlRkl5p%fUZ0sx}Z&^tfhKZ%&j3Y^zq<Np`V&?v!Pzo*ABp
z3P98je~Hg#-u&dwv8S(YaJWuo7;yqRw~%D^A_A#F?YCEnJ>RY6yuO=7337I_jh^~g
z_U!YENi0(tU{vox>&TERd;!qx4RDjoXLy?yr3={@*yXSq!t(IZEd{Rl4Y=&+@UaO{
zn(F8nqtRjP@5$5Y2mD(|zbTWBeI8Y?ey^dcSoE&yw2`(3`PjHGzF#Cf5+Mg@`;s%j
zZ$9W-yY!urtFgVhDmK~q6?s02*SdB@O+gIgX;T~6X`nA7_tJ#~#QhZsS_%8ebLc#r
z`8xt?;qwmC%qFWOkv*@<$uElZ)XIU&g?@ZFe^(p*62nNxpHV5&L0ShX(0ISjCTNYC
zamw?5O-k$AnOb-_i25T@EM39SkjA#>YkZN)lC%vRwX0w1$IP)BYJnZ3^7cufF{=ek
zdJmioVx`(-%%^@PmTWLf-?sAQb#iBAs>=TjCf}E2%=D0B9EGEqkzh-dufQa2Kaub~
z@52PrH-MPW$V$ev1>t23X>*F7cU0aHMwzol%8Y3rmurk^j{AVg%49F(2c1?_^!eg8
zc;^wMm+n6Y78NnpT=4`$hO`jRBqx#hpBF!d^ph1sT1x@(ZxW}>*aASScjbS8tEHOr
z2;!%vo}CC{&$e}L0&#HR@Bre>Hq@o?5@m_xm<sbe=vr4Y)~uL=Sq_5HI;1#kT$~Qv
z&b$VliEqSKG2BK{q}C=aVnkz<@sYCvg5BoaWj8T%KDZs3LxSCrE{{S<Apz^(NaBSE
zgHz@XP@$8jXUI8<FY8mRamo2w#c1lqXs5^;#c2Fl^AeD+r1Rl&o8GG{9hXPw^4Ii9
z)GEQ;%SlEBi-NoqEdJ$+apW$ffD6Hy=Ine0n56-WXytx*BuLH)L6~0q@^H%A^;wns
zb(lwAajy8qzkwVGL-rNTuj&I(qIX54u@495?<fm*i=OJDp0ZGnn9~;D8N<;`7we3l
zd!!svWjPnl9+P+8LN2|8(>Oa+if_z&nYN~^z@RxG>LpudaNm9`_RiG*EcU$9bxil$
zGAoK9rQhpRVf`GgSG%#Vpy3z@DrHyStAro{1zF`$1bSEDa}BJcQ7PQY{hx|KiNjJ@
zDs-B}(5w#fKufk+_j;m{%~=FkTCe%Ht;M%PSi+&(IYD0V(P2(;8<cUMnBZ=)P`EtY
zaHNbBEML8jX#_xtTI<v_7tE#;D5mi}JJl?#MnCjJuhZc-DIGf52054cM^?vV$v^v%
zTRKpH`B_^9QsA9pXc5waiSUUM-)8Qkdm%G2aFU*pS3%5qUg7P;hyLo#>io4!*ha}4
z(ryYG6uiA2e6E#g44Mx6jGv}VgIeLqiL2Ykyj|iDB#=(4zvabZj!%jGh;X_D$=dL~
zJw3km<sO4-QPlXcJbaZ~oYMjM81q-Ai+0z!IjbjO2)ce!Yx7eUep79yR2z3jw{R4#
zJM@p`zaO!$VhLz6iO|qgkl8&a&C%=608UU!y~e6DJpIzA1&{AG>68N;f9!w8YCaDs
z2Vf+OG*BmH8WfQ^+uH86KEG~srRYHV70cW8tI3Uvwh8$q@*duNJ%niS;q;af?z00y
zGo_WrjZaC~BuHs=(t9-4c*zG<z#nGS=pSXs-Wj2G)vPI2@|tbsSb`Eg?LM0V&%+{{
z$;>qgsY+XL9=mPN)*DXJ>CC-ryoWLh)y2XY)6y2BMD}c_dK86+aL?=)Mg-pApC~qo
zp<7_p#g&T-#pCaTWxwi~4rmLqzo(9Akv9iBlZFiYB%U#pA{?m9qJ>}*T$GrtN=Y!C
z=rIMs8kUK7I6BAxscFMvV=;9Kh>4oJ>8#@c;zvmU3ipg^6kHgzy3gW!cXS~5;vuSW
zjcuLULGVR<F?^B#cK(m=zxF@h|5_%H+|obazrugM|Fa;};l<`9T>~DH((J6)__*4Z
ztq@})^$7g5u$0q~2>QM-jY@THi<40*a&wFi_K{D~=m1v(tR_*=9Cic%n5;k0|NoBv
zm2sCAU_9bQ6R=cJcJ@Lp{Njl^=*lH+SQGi=UU!(Ioeo5Ymet1;e|ganJ#nFCl(haC
zr!-)9$Cp@f%IEaKL$efqtpalx)AAxYWE%C73sqZK*fXfk5QiF_G4>o(M_5-<Xx$C=
z7K%lEC~olf!z^H(EIZIzWYKGD7Qp)DRgj;@F{tl3(tk3xS=>U{JFNQhMOhB5ih!HQ
z>!g|LBR$Hc`F6~x42C8(K&%4bX0d(Hh^_=iYKZy!!_Xz*BRcpR{PoZ@LK<GsVUKOM
zLL)hIR%H(0=+y*XF5)(!_Oad_rK#)vvZ?pb%`De<2F56F%VOMzfnVOh)kD_LD|%6p
z00OQ_Eo05G9&l2wWLRQ>{Q%Y~BU#Oa8NGmD@h)Ao%+arQ0ogE#0iv>SdmcSJ0Lnam
zgI9~c+E*Na>2KtG^X7N+kjj3Agx$nZ$PN;Ka0<fzuy=|ZC4cFu7+Kjm!T^G`1p_qi
z5(43)Mv}6@JBPIYs=-c1=rM0_Cc4~wX-xiQs*9kPV=tu1$ISK?4ItuC0O5>HAbCdu
z7*uj?{E`4b<3-|=IkW$xfdZS&F!wI<)G!#n>_Ru|{}(6l!1DX;bBP+=-Rd%3S!}G%
zhz%wM2@6bx1<Pu<ZQHWzd5LLxlnM<DjR`ABXTi3SWY^y-P&m3H^^|)A8+?etjs4HQ
z?puYSWUiLn--rp8Duj*QSmDn<pzotT&^yPrx6@Z|j46Q~R1H1OkjB=MCWEb26lI0t
z(WQQ!-qdS?*9Zf<3CL!1v0PJ-xy+*HVz9o$B7RA!{=APbcapiuq82%vS2KwYCI#Lc
zs<#O0^GF~FBZ=njVb_ez2Sua#vrR>W1&SQ_Y0r$`oRd*e%LZE^wm8_)3&d~rCH1X5
zzdn*;)%Maq27L8OFFc%obkXN2hN+KGwTX{GT&jXo-2iBKx933qjHmLUvsj?p{HVD;
zc%dCX#WPxhv464|o3&wojYMVv0?l=2y=ujg-YJfP_V0KtbiHdn9wbVvgO(x2y=tYM
zw`j(0ybPIq-b^ZG1I$3}$4n~Wr$(K@#7>&Sj0rb~X}TbmblM9xdpl&mzKVKxn#QFt
z(ck_4d-s+&O=y8tI1`v8XbLS_=Wyi9_qd)#U|%Ksu9C#SYBFeiLFs>M$Tt@FCR!I_
zs5sR{voY~ui@<GB2AfGDh}QS0bsBg$k=S%-6+LV<fu6qS{DFag6DhhK$r(iBcR@9v
z0%R$U{T#`+*Mf3VgCQ1V2_AQ7^Q+AgLZc3$Cn^zuCP7-kMb_;ELfD^ilNy+Hi?2SX
zfyxvE+=5j7j0RvFQiXhVG-AA{S{qLT#hk=3ECh3{QrDTDWgqRu(xoNnLTieE1dRCR
z$&FaA#>;$qxNDG~65Z#{Yx&1j4jAvCp`GB8);DE=>654jyz&bd+>8-z#XinHYojT$
ziOT!vdL48k0Poa0w-zt6NsW3jmKtdwBBtZ}CsIARvKYIbiGI}DmW7P2Rw+)fj_j1~
zH54#~-qixd%ESxFfrXmP543Di480$}#WdxvCjV6?Vj3yoKda6b?JwS9_C`C6U0>=d
zG+!f@G6*34#=^6`zV>opWog9+xy(EE{iXi(O#eyiCbg6O@NKkA_;GgsK~zp=lqRSB
zsNJ=^(C4@A724f>|6TvwxNf&DmRIf9zv)ou`l$a(#CSVtR5>D(7iwrhy~^%_lg*<P
zui!92>LJ#IBYm}z{SNRR@=lBf3QsKN#|LQCtl_*odZlLh7a1~8Kp9XuhmJk<6=N}=
zkIE%fZGWdq0?<dWa39UVA}r#d5D>iqA3)@B2_R)4+kXSN#z+$2oT90NYpu&>NsMRu
za{DPt9Ht+&o*x=U7QG}WR}A<8rx@0(zE&Qt&0L{huXjLy<}n^~$qAt_=uu0&wAbr#
zl<p)=0w!Net#tRPs%k;6GjxQ`Rv}2&vQ&S9l7^X0aX6Eq&7oUgiq)2}nx7~?^XV27
z?DB+J?fR0rMK+^hJi>OdFsRl!?Y63WVaE%hC}>^H@X~^zKZJ9uPeE69rK-GkLLAnx
zx<vo00W(M!tYr5|Wl>EA1a`lY`m?J|TMw(FXXtLzb|u32NM+V33A}}nEkb`CNeV2&
z1o6oCGcu6X$FrbGQ%wqM=vmtq-7MA~eKfjP|8ol(wmC^s5NsKRreEv|7M6&Uo6XYi
z+}}SRKS@8~H`Y8xpFT4U0xWPTOM*ch18Y^=s6JC+y#M|by&TCQU7W#~zK{Eu{z*qX
z%Bvb%L_1Mc-*%rqbTw3P?zpSiqkae736B$&*0pN0K0YRZzs(zqJ}7J5`i{L|J4`?5
zcnuiXBX3M>rZre|uiHlyiuN$qTpdoAUS>NOIx?|*zXaNGjWN3(Kbw7mL-te!o9!-p
z#C%)W=L#5Y4T0o%E~iiLc&WQ{%dyCk&)~q-ajUZPo~Z?@-N~?TdB$>>m98foTn6oj
z*)MtI;*n)#WxAQFeHUU$Ev;9l82+ZHQs-x6xW~q`W1WuR*zjXo(rSFC7XW{6@-6_(
zXlE!puSbkejv8DrdwZC$3LTh=O9ziqJ^1-$y~!`;71{tyFse|@Aw3q@JryfvW!g_S
zHm;#!n0#>727TtMBpLiMTcJ?wUn)l1o|+)rnOO)TA2x8Ocn`p%;puE2<2E`!k&BCW
zJI73}(Ejp0*6a3S?*~wMXO%Q$iP0$*J-LfYgp-39XYN0*0Bk2{4A5mfId?UOoN^>p
z`XTmO{rJcLB2I{IvVuQA#my8)A9HQsjO*D$=7wCrb>JR=C+vl1{4Hmd2@Bh6yizXc
zooDmE6~*00{jgo4Yj!(A4LhRJgnVDc;o*#ByPuvIM;8(mXSXa8Ir{}gvvO$B$+D)q
zfAKv5JA{*H`YJ;DdJ_O|7>X-^&CxMf0j8&qkvRNSXCKw1t3YG{f-LCskuwYJ=uF1v
z=EBGsbrmHIDvCA_#j!f*FeK9}b1|Qd(}r@hEw5V0e!K{(vkQ37SD-!G_&@~&sc%YI
zbAc#@y7<q!rl-XQEUkG-h8!z1HhnmlUZJNHVAK7Jtacam<i!p=GvW(D?R2O2<f+JJ
zyTiIiGs&Y2aNT_J$$^JSXfK1>>X-XWOsELu`gi5E`Ops78!3qCvZY>Jtzn<^iC4;W
zPhy5yQ7%}q{S+&%9knzc6?)59`3Ql_q;Tv|r8$tKU&-|S{4oddX4t*Zv}pTdCy{v0
zX<CD`4JmSzT#?BW$&9l8v>`zJ9MAa(Ff-D4*G?$`7>BpwZbeK_HNy?9s`OWSbt8S{
zC(kI*o`R-a!S_luD<TiuRv!Uq!q8KRr{>6sFbiWVC9hnvCFs-S{oWeABdktcrB<bD
zQ(f?o0jfM&J-KO`T)Kl4&-D}Ct0f52Md9rZb9Sd>{An|jWKhMmc#~wpOh;ExHHfny
zbW;I<4>S6Ax97Am$aWcCX;krW;%{a`1fVsD{Gc^uyVX&EEGa;{j!BU94pPHFJ=*Bs
z%E*Fx4`E<DTV9}aUo~X4+1kNMtkJ_!Jm4*yMrx~L+bgl6%Miq3sIbMfcBje2A^Eq6
z?6xZ(tHp`}mkG3r@8!c?ZN|KBH^XLss3@#&_|X|h<_5*=0D!oXti3y)R800~gI;$^
z<vEJJGx{n1Mqm%6dcyhv5$5bj67z>1YGb^qNk@wID~Gh)-e~#;(Zia<ymFp>wY3Un
z1$x1o9OjTM6#P<kEMeYj(;S_-r+XLszVpZ5pFPqg2kgo?mAwZ7;~edi#ZZnVoloW6
zqh4!gviEAX7NT?~L47C_$(FY`9%mcJotLlc?f)<kT7e|=Rxw(0%MVBQNesd8u{#3q
zNf%zOM~QTI6rFU<kD5ogmIkP>p85CJxm3|_i}X()z8?Hb@1l|X@7X*$dy}>DUSkIe
zojSxEK)I%O{sbzYC$oXDAYQB}pa`~`t)NrZpSQutcM2%cg$IDEo}7EXs%u)CDpicf
z=GJ^2{g!PoxVNiIgMU8&!>S%$aqO&x_HNExPHT(eRVp#)?9H4w*oTAuh_j~q@1m|%
z8iiwQjiC2qdHewmW_A=agf;Dv%P8kiaU@wMFLmG!4zStEag0=e)E@Q)cIADM=fa1o
zHcS&dZpBP<bIGV^r@DQ<r^-iqgYqV<O1-*yxo`vu&^Gap0WCqj7n8M%tBu2r;~2Ca
zA(!V#Vhu%&&ma-P3m}QLzX;oC3z$nZ`WqQbIn;8Xs5J5GkL`Fy4|N}z?6+7lDD(_H
z#C|)@)*6JB<?$ykMD7uQJ`wTZuWb0(-sMt%g6VJ$C{cjpvM7{Iv{&+1x8UO=rz=do
zhK!D_d3p@@ld``%Z*QRB!=FGsu~3=sjwZSUwK$45ZI9<AK5TWa%tP5>2D@VlM3zE_
ziB0@gGb&NZgH)5|a0M>0UcZnijt+;#^zUEUJ1_`)Hj7aC++iPvkI|}-!QWZKb7G6V
z#bo!j1R_Qm!cS*lKZPC9L1uS{^ZP|GYRhHwdNP4zBv*3doKW6FF*?LyR<p3%fYJ3O
z5l465*$nw$&-ul-GmSc!)7c*Od(@}igROMOn$4$@lOeb)kXv{q8E5iLmQY0d6P3X`
zY3rldotq7VHEP<#w_nH-`TWiH+*x(x&G$My1<ht4OZ1_y_VBmlD9Fs;{SejPp(HXM
zK*X-ULKIwbF|y^}sLc#&#-_&q5UqXZI$+I{k2Klv#pdpr=Dg|j!wYu>@sk5Y<ZLYG
zcmj|0<N-_hV1i))GefUz0D#dQ=X8PFHPye$`Fnhm51Im0tLDFRZF%n<tag0__{7=)
z-*gr1Y+q8ULaVqCIVP9^t#sKpdLEj;k1akWmMe?<AUu=$APjeT9-fV3zx^!9>&gMD
zt(xN%=hlX>9cilq?(aMqciE$W5?QZeanD_P==kf$2X}Z*pNC^SJ#kn6EEI*ItA)Dg
zqwH^W9W#rJyXf^bU%Odt-(xO@w#_21bXhM3BvL8)*pWi(y|*cYt}j<MRcl)5He+Is
z&j*?B>>C?^qkFIX@8z{FYvVGX!1kOw%b)K+WBmna%3H1+(w#Moav>>&Ry7V}i0B^4
zD6>2$@35=g71Z7J441}xr9dU`aUQk{wzIwWBR^g?I}wUzZKagY5yiY!Mo$psP(K+q
z?0RcyeYa#kl1ICtC|DNj-|Sjx@~pLbH&}lfY_iK%Tsx5d_u-ec)e~L3x|r#bY|-w(
z^!*8@41oTcD!~$~jPI)f$P1xlxMNz>A48iPz4{vl3BOqGR!VvbQ7l_TuQ$J;@%ptW
z-i1lSLzIE7s<A-!HUp3v#KT{D8LxmVU5xCo|8r|$S+RI7>|}&s9}va<%^WlI@Ln0@
zY$$INzxbAzK~-VCy}^U8fuwJI)?WhkXCc<R)W*{@Hh6O#d`il=))rjkQ#k8lyI0#X
zBWNgZmoy!G9b5?Ts)yo3Au;Uo%bX%Skdy9=v!Od`enzc9a}<@aBbGjh^=SqS*5V{)
z2z$yWmrd2F;zXiJUMI4rYn%B(8yR-JSWsIpW0=%E3zquc$a@wp_$Z?hd{=Dg*|KD0
zGt!lA;jU9|w(gwK0vo#!-^W3DIPA*8JwX*asC#E;gSqDqE$d1*a@o;tuB7d|NC^bR
z?!}9kzh?ImM-Y*wYW{i`tU0iCJf!V;wf|kE$2$voaPRtD49w`yz72teU~oMLQ5V{E
z-)P2=PbO|NO&t5pZin(%yT6Inq!8NU!#YQq3ip6=Zd7)>HG9Tt98S%4JJ9=bqR4+s
zO6wRJj$sYVDs!Lbos9dwxdeA1J#hB1!qwjU_TA<uhf+s#^6e9<#685CucH351q?v-
z=9A3K!ub|xX%i?36OfrMksq|?xxDfjyW7Z~+R?usD$lu4uX`Kqw1Ep(e;@5O{GvRY
z<bA*5poQjnKRt-Zs1c$)C}yIaiN?u$Gr65aP(FI$^ySKq_*KNO_YlrYl8+=5xj>c^
z4_k<rcfc`$s-CceYvkB-Say{Mj+Byj>mHnXa{9{%vy8~hCX>E41)^4MhP33V(EKyt
zm_pRa2U9%t<L?S(LXt;CC7rP*`ry~b<I>j*OhtX5wM&H#y6JG7PF}Mp|5kZco(kZ(
z#c}6jM}`0Gru0j$WwpDG7L}l@@>hdbsYg4$yZ%pkLaOf5uNB(h!0cM?UUv=4W&a<7
z+iUqzR1{MIa3eY-Cgl%MU@xi*%mWU%%?!ZQ#_wr&H|<g*8ul2r8kUm{g{lDDK55n}
zZ?$($*vF#zv&_bU@aFGvL$erJ5wBd<-f`iizXBAg!wQcIv+$BEI;SP1wJZ{zZqc}b
zeMXN^GFa{;)}YKa0$j@v%AL_tI~w{|7N!qPaBeglTsL!&u^L8Dmxq&wTJ(+Iq7?z}
z3w4>MK!<%Z+dj8rETAj3Xo`oVAv|JFU<!avzlZbl@NO3(ptT#czI}3S^51M1SL9e;
zL@1c>E4!iY3Gc~Rbe^#FR1jB5stJZR{=r#gHYS`2YB*A;V4gsib*@A-rCAJPfM!Nu
zTZBs*2l#&PJ%fk^x;c2QvermVd`tb1aeN?{jJKl2cw=l%1PHUW@g0F2c|;^tsokuE
z5tL`MH~I<d5<rC(-6AZ}<Y-jG18*ENPj)$^9?8Bv#Wc^Bej+he-w&F_4UrBM8;uyD
z0WPYKpN_JP0K0+#<%GjQAw874f(S>$EKVq0pV*Zp-yQ&+3!AHypA$eZXh&}Bu_tS1
z7?4{_;yUnQ>A}gl#P43eDLe{jXb(PUf-iD*a6WW3gW5^D0o$&-FFN#sAJk9qjE{&-
zb7y;GZ<zoD_w6Nx?yJl@U*Qh1kF1-yGZ#f-gJUzm7duvY?=-Albc7L8+Yz}hGhMb!
zpxJc)C`+UahcmTiEdVF=?<Q$r<h7GsZd)vApra~$qoyCg2Y;mA)w)Uf&6+SQN8Ldz
zao>MV1qsHh%ajoSKw|{50~~r3&P2&F27;&0)sLtd$po8hZtagpk-_Vt+IQ1&(XZYI
zb4!4+1g>e|KYYP*M(-&9!&h*HZICOIj9<cue>=-F)P4oZRYZDZ=1D$#H0CH?y8|pR
z1ddef(YI0>2BDdxLn~GkzUp=;J!3m=q#ZA0c_wdNpn?%9F6)zWD4mETNlx29v@IKb
zuuD#pqI51Lzl@MsT>UcAoZVt)n4mVG+yJ-aMa7DSQK{M&&GV-S>PJJ^_frxrqvs63
zbBDbpAzYZz6^f^fx(FcY?st|r;OnPE=d#bTJzz!an}~7RK_p#FA{+y&Mp-?+X&7A&
zrK6WKsvm7N%hs(YOC~*lwA1A3Pl}!gic69s!XoWboD*|%`xu9u)27((g?FQc$hC_3
z!=K<rQkL}fxf%8H?D6-FZeR|q=jON1fE3!Qy$^_U3@Y}`MMMGuHZ~!yJdh7?Qb%)p
z1K5R3<mV`b5&C#eib04#N~&!LYI8WUC^N(kGJ$pS&!N$BrH8QmxBVkNDas<M`O)B+
zAV^U9x`V0>JhVb?m^7aGZ>)=XzbazTlGHH(no@3V4(ilJyGYj7FoQ0A2()$GuR6n8
zi|Yt>qj0K%*}iN%$l{z<yZtam<e9Guyv)RtK}hX^2MtJ#SRY`{`;i8KlgfGWD`>`o
zN}CjdgpiBN?rysRo)xJ~M+B35a$mK)<L=;jlJ~#v%x<Z3r6Z*VEldu-B<|1uWuyJ%
z2&JQ(4{XIGM4eHzX&DEgtYT^n+9vAgQnyl2!;%BTYeE86T@M&6&hXyAt}{s+IC-PK
z5M;W*V;_zlp>UFzWtAT%+Gx#r?<scw7y!ptAV}1~*A}5{^6WC8R4<ykHG`aW0=iY9
zK&CBjO}AVrQnc@QWy;UH-3h8mnK~xm1N=O*Xe2n<8=qrWGg=E3t$LL?4pZfq$xbbD
zJ*51Et*LH|RE3cNSx6mQfB9__XeYUakxHu@lub&TH*n&*!jM}CH+@vrV|5ol@;d0i
z*2T23ZNF2)@@%~-1;Y(T7TQsqjnX~pu|4K0J-VuSrP!Zi+Rl>lY<rE(R<kyK_`xti
zT3tnI3}(F#ZP_a6<+4-1Q#xw#<=WR$5hzR5W&At1n2IH}KA}1{VpP-MxYP4{PFt_?
ziW1r-rL{oll8AB9j3E-Jh1)}c1b*`_2~%r}am6U>Z0aK=qHxWuIioNrt$rW_|9ZfN
z&O>~wRDN~rYqpl!kl(yqHXhxiKQ32lkaGFl=B>l@+=M4Fkd+im!c<CgOHpvr<CM4)
z5fP?3FqA8^=&tdZ7dHOfph=SbIZfpQx9+Szm95)&Dhst-&}22+kA0`*uYZfG%EPeH
zS`ljNp(gW6_nd=fd(Bz>UcNa?$J<DAbj4P;%serKbaHq3<MMRr7jKe!%6y;*E52YF
zMD<lXed+TRPGuTRy_qZK#nlI*bUl-7b(p_y|F|GTcP2NXwnSN2W^!hh5=n1z$Ni$}
z8deY@V&Qpep8kAC*JBAbx>m_e_-3Zy*q>LXa8yg;U`O)1;LU2-172Bw?m7pt!<FG*
zS7SIVzY&WSyUm6B(C0K5;*E6^R-zGSz@5ANj!GmBb%T3v3CG}~4@Vhb3P~3*I52#V
zX~QuZc!f7O^ic-x-U9R8a82-tcEJA>%!o3XC23yE3MOm5E4q9t6CQ1HzMc)LUu<g?
zod)ZWmi?BWd<%czNW<;>&>1`>8@xIT#kj7i4f>tn`Rv}%p^iK=x`H;oOPE1x(EV$0
z&v(5z+3xL~M=N#vSXDvUa&dV|QzFwIKotC$p4l5k5J^CY`C>Uy&lix$gc=dMxX3Rh
z<37FP*YU6$t~OcNr{Zi)cSr#}PmA|M@#p(PH_;#!2mx1jMz_R5`^MRUaeMWW^&+lv
zFdyWW)oua0RWP0I_4c=hbczv`IQN?0D|~Ia&z2@iThReEe1df9x5)rZ$=3aLUy`T%
z)G)mkoy>_X4}~&aioXsD!5K}pICuU#oD!5I2|@7v9HoRb3yIg?w1b-{Coi>0RT`_5
zPl78PYmXbBI?Rvek-lj87x7`ILlc_t`!bKV(JL{mM>jTY6Qu|x*Q*N%Wxfl5cSlbF
zomK5IVEJ0gSQq&uHkdB`$+^bT1(ONrA;Vcoz}02{wAiuX@ir&2yt~kUWoBwP1|wqv
zc;}}-w$Z7dgt!*`lYKScE?49#w@zc3;$-d0kb4+J>H2>O@hwyL2ZwB7mWRBpUWir8
zE-gM0g1_x&wF*rJ^bn?AD#V^FZKA?N#EQ=*!nGsW*tkiVctXbe;PZ}NCxmzhyxXjA
zPj5)tiUr~5mC-YiO>?ceQ-f5*ewQP~<Wb_N3Kp~<=yCImeGfow3nR)&Q=!@LyCa)K
zirGm&8Wv=sn7F(8i@bmu-=7J0QlBf_@VN(nALM#+wCp{m)+7471~^g)HG1omxDwd2
zTw{m5__<+$xd0X<6)|i_Fi}uU$(K0Mz_p(t3)L+?_~#aM?>F(6Ln_-G+720>pIc#Q
z5xc?U#`6azNShTH&enO#sdsm^c@Ot%Ic4OW3D#GE51Kxwr0As615#gAWpb=6BFLbL
zBmX%6ojx#5$&+;0ak?e<NKA&JG4{XCu-B)csy_<ix7RDf`@c73?1AngpN4orA>n+V
zcL2P0$X}tk8wIyL$VH|^AUW5O?v@|ow5XAq!s|%w>%MU;s<+-lS3cMoW)JJc>T#xi
z@d*m6M#GNK61a-olM%xiwn@g%JrD^r8^`u~m9`^hN28kL8_9~qqesB*(W1_*XEc_a
zT;2k*hvuJx>xp*xeqq_D$v<s%jswqyh>YmZwfif}@Mcaaw${+;>MP&2KAyU317Z9`
z<|BaZF%-7;I%oBP#%+spJDf+0f9%=vN7JJYwO!u1{!u4+54>;k&_G$U=MPeYMhU<)
z3ivm1VLn)Eyt;{r$hk(h5Jt3NMdK^eXI|BFDQor>H^#rd^PWIZawsB&Z)*K0$@?AI
zQoN9cy(pa0r+V2<p+cd{a-}hP0ehj9&^f}03-V+pp6FFiTICE05yHTfh#=-<L-n{{
zn(osSgi8Q8iH+}677g*~k(2`56ZWCrj*U|kh1SEj@Dl<CRKoJ-85JM%jyJ^X?dpgD
z#(wG!4vUO>fRqMUsg5T>y|<temPGY9aXlUE9v<WKhh=d;Uw3x*hrd@>0qbJ8?VlK^
z7a;R0+<!-2xpO8aW{$7O@*J3Zkc)e;U@5fvhyLfmwffJ4%K@isTZ~s?`L3RS7|LL?
z=x$Qjme}1qL}ISWl2%sMhmZ6a(UzxGywEzmiqwVJ1qXM<T5KBPOmp^CAwRXAR4Sg1
zXq9DbR+DiyWB$VsMf+#Ml?c%wF@z{8TN;7CuOCosX(Il;!OV+ywe4NN#A{Kn_^)T}
zl`x|Z8)wrdChv4hZmm4gBVWCC`0=0<%DY$)sKX+9t!fRbkPM00-Q&XaM!^F55B=+3
z^~Ma%NM@2rYiel^tHUM)x!Ska^7v1@euM4-z3vFUa%YCB2DC$|U!@{?l`I+jxE<!?
zq!rXbo!*sO=T*|=PlrAhRylOIHT@_i;<wv({ov2hUAq|$=t}0zCkHz=ZfPHqiX7o6
zYeb-$k_CgZ6@Z&&3M4`jzO$R=em7&fLxbxSno+(JWs_nqK+8=5olOw=17nUz0*2;w
z*_s{q*b1<S&T2zWLoBeDq|h?-)hsFtwdm!zJ{#X#3~=Hy$IZ8iC>BM3Z1E1Lr4@kz
z7wJw-gYCw=S->~hhOKEyoY_PxY4w*5=xTm5qm}Svnn=^qX$~zC<aZr;Nj|X1=C!S9
zb>5e9&rEi423EGmdyY*uvEJM?B#%KhuB1Eu^VdEVTAbY3?w{tdD_O_v=0-uoDK~o1
z>r+F-DUliSnw;A6i_4)F<*$ivov&9SSK)#RD>kcyy|frj{;67wpdg5UM&OapoN7D>
zJ(1OScPcD>T>$v0b^xHToE}F*dtiqv55_353<NBJlE=XZ!m9Ze@Tue|FfjGfp!qFv
z=w{&Lqm!SjkU*i-204$AqJP$J=GST^So3UEKz*G^<5_l;m#Y3+3fZh&?{a;@!fAu;
z(6~OoUDdmpcqY76@Sp^W5HfC632}-rviZjnxj{L5(ePG+wlpfde2@j9{Zq&lQC>>=
zIb0(-XMMWj*s`V~s14IK73?U3*;dX$oLVf&{1Bp`H7vh_?RR(A=$^I}Q0*6IG|2N?
zenV<{Slk-$%*ZC8B)nMZa*J#8{a0o~tb(DM6RNuZ)lq_V2~>9qph2*~(zCjsXQBdC
z&skq$8hs?Yc_*G4VIzd3A9t&toCELIf$8o+>yeDCI-1)es^60OR^fV=);r!fT{}kG
zpB|fOHfR;N#o13P+EC#}|54p(-Oi0!QjB|^$-anta#^P#`{YZ7rT~ZM%;%lCUB#SH
zW+RXAHpcP4(HS2vM-QtZjFtF9&U5O(-0@%6a}`j}IEwwl8Sn0|kFqz)shE|xM1IDO
zhAiQ@DrZ25_Dfjn1!80Zc4-+I*{Q@{%;QHJ=_R2ipwxF(dkj|2%KVCB(wizkddVh=
zMkUBcy-d1HwCQ|75+gFdsVYQBrFWo`glbVp`u0V=v_yP=!!*rX?R!lLKoWrfZ@1YZ
zVnE;|KNK{CN}HKlTR7o?^EYNlDw*A*eKnd{l`d}8qOyrx8-oT`IcH3^rtg)KhCnX)
znvo!S33<i#9ioGP;S&_zX_%n+{6X&7pWkshI)*r<@(!I25(fgr48_lJQHP*w&_~Wi
z-}gsppyyKyOvEAp5DeD6#&=vyd1+$NJ@a5_!>m$4{1tJ3`1i_`73l^+Hm_XVJvDfB
zm@egS#K-7pJ<>e!ju8^&tD&0GCigivl$mm0Id%n`3Po)nY8g0XH{m02&j25Qv-z)b
zdNmXbWmFh#p$&L=Dy22fp;AF}I%PZ1^gL&vgdcP)l}+TlCN+#mQuk32PWoc42411R
zx`NSK!|b}gvS8vg_ADj+`?vB=B3DH9?h1krYi6&evshFa;4zf4Zz_)Y%?`~LL_d7#
z(?SgmG}iHEdWilDLeu8;zT+DKw9H)LmR*HkBjFnZ^%X#ssuEY0MZf-=p7gII0io;%
zK2VE38=1zF<z3{60_n_sBX;j8HG9EZ%^o{59dsE#r5b0D?B7@Wse0OCCi0M1^Wito
z(uIayJ_8;zy+QlUz4IApUMc~-Ly%ZsTFXI%su=@3PwM5EOMx43UtD4GQS2B?ft%1#
z7PPLq=^;A|aEwA@0w~Zu@S4cH36L1&sxk5*J25q)Ju9zrto?2&3tqLGbAWd!TgJwx
zHgfLFEbIGvb}~I@>TWn=_dwUDcwX=c7@pS7hxvM`Dif5-Wj|TC=0kn&SRH@#RsHT8
z1>Mj22!`5c*tx7H$<RgTd!nLYDNjF_y!yVTC`SM&Q}=IBLyv0?A3Jp-Gh(+jUyT%s
z#CDvGTt}^=VIXNjk>`3ZWYjr9j~!EF{6D+7DA+;08%y;;JFO4-1!Oad^0^N-PYOzh
zA4wT%DfMDY)8%)rfqx_Z0u56hX_)kOw!I<&>3*N&7Dc|@e6URm=HDn}WIDu7n;$n0
zJg;t()@fqP)JkVR`fZ=s*l{L&Z+b<>NBRZwI;y2w`(J@`g`pO1HeNVgdQcui4{!)v
z;;!Q?sU1nK>2vmh*XLFko1)Z-dKW_gkY&XVSyubdoG&A~YZNl$s)~e1U9~094A(ld
zYd^L-i)$P6v$6)n32LfaQQaSonybTlHua_9)TD~dQI@G+YRKIKAJh&qT_03InX!a5
zhM&|eH$t7<Z7gj-OFUQ(*4IuXlVw?~-mgL)&lCGp+<m$!mQ#2FwVCrj*(PU;pe;C=
zx@fDZ5~;WMB)NZ4zf-HX?^M09LIKbJOra=SM+~}IH`Zf?)6zcun<gE=D?#q*-ZDgD
zf1>L6pzN?-o61HY=NX#9OVn(b26JtkE!)Aq0Ls^2W}7CgF&~pwgX!Oq_pz}1u3Wtb
zl2)bjw;0~(OyDNHk_alSO=qoEH<`|;+u;nKf0<^s)peXjI5S0Eql2ao9*xY%a#fcL
z@>oEo0P|4$aaZosb}EpGpakgyFB?d5?)3MjizM9|RH^nz8{~l5a6A{M2Pb%18U!Y~
zhGJ+g0#X0Q=!7yU&sR;8JwpR#fokj)4Ug;(6^)cC`!qomazh}QH(&_3Rf)2ZdhB&&
zc=q1r0?Bu4=?xK1Z>GYh`6Dg13u$2YyrO7{F^)dt>dN1-dh@r7+&YTDKXI4a1f#4s
zH{YWMU6s1NKqDk5@`2&mf)%sVqU&2Upl-eGfT65u{SL}2_N_|FUvtToau~ggO+9-`
zbI)ln4q{OK2qU=!;2E3TqK6uSm!Nu`MIWZ56-0?M|6ehQSG#}edn48)q)W{ZcaHpX
zbx{6y_(rEW<i_0=ipHU@`tsDF=9UtmEvnrR%I}`^HL`FuaFrV#D|piRnDkPtU_E$L
zr5LLnQoI1Xd^6WJHyy+%beB-0BnZBxU>!GZOCr1RzH{jW{9enp6fNPLDB3@G>BU-L
z;yn5`A=a1%G0E2ZF=_Afp?Dzhyxn#!RyBt1u|u<t_X8TG6_&UL-lnw9mc%OYb=i{w
zku)R1X$R@yD?`?oD1KONzDKa7;>$iNZc>hiF*R16E6Tyv>0vu2X|(J2d0;EA#cVrt
zUwNHYnLRMn-K*{!9M3S@7!dau?we^!EymO7j)$<yzJE`*SiRdqHB~P?*ZCGUY!)hR
zDA3gI(oZ?tupsBawx3qj29}&*AXMSQzg7Gh|6O@gn5yeyFOXOcjm*TH`<WUQalzkz
zI>%DMtoWyMW$86K(j#1>YFF2O$<lYJ_k6~Ox^}?`7)6*X2xEmeK)Mz>y+aZaEK)|u
zuJ2M=fxWogD$of`=pFp(fwZ*@+?;R=O;-ABHB3<)B=3-^PhS_p$}Y#MZG@Ixx4<Og
z5Ds>7hYerA*4+zF^W=@JQ9pksiKp9GkbakXmGS%zvf6Fozx0L)jx=Gk7%iXzAz_1e
zJ!j=8U<E%nu6?L-T>)UyobPXdGz+hh-O@OAmGlP9T%U{;1l2gC2=5~fvC+u`ht%U#
z1Gx7A?BHl{89YgW(x+=;+@Z4yLq#xb#(AEhwo~%o3bGfI?HIMa-qu*;CI8`Ll+E0m
zZx-1waH}7lX4_ro<Iy%^@1D-5q`Fi~R2wk9N1bV36udF5Y`&7DnV4nipn!J=B?s3<
zHHi|VvMm|NrKe9gzer5uAc_>K<*~6p7hY3P1WUCSu=HI`>34Nh=xmO_o#G$Dwd>-H
zcxQom7#+t*Y(^sx+p<~CNeF$`sSrQ#7On>W-IeY4lsDj&Fep2$Yw!zp;HWsK%Mo$+
zD#805QJI|2j0>h-s{?MMG&nUbGi(h0kGuy=LHSF%gt38i=XKlw?9xzhfzs?9O7xy<
zVnx`9&b=pOX6#loX7W;YGf{pu|9Wc_?DYRjH!0SV7aaqgF*1ZvB!9npd~vHM&xx<4
zP4ZvK9Na@#)qk4S&Aj+VM}03eH279mdy%i;YwMnDUL=veKH1?ZI;u8E5y&YKyJ<sY
zpui|j=@qlhP9rqPo3gPt$HO^x><H}(Q)arLB{YkGyTbc4`{wz)7NaNPZ^<ch{DPFA
zxcI}mYSz45dg!k?EmB*SlA3h8U1Vx%j!aqd!`_?9{Qc_w{k44dTU_Zq5Jz0u!lr^*
zE3N5AN4X+3oPx^BsN&aejpP!MIo6qEKBL(Z=eBr<TPPD(McoGVqNfRHA0_<9-c!Fv
zt%!rND*%Za41hg0WMiS_*21Ih%v&&0+#4<?WL9U^Z7n#G2YRW=gWq`C0W@ZQv55_&
zViE3lDukq<Bv5`<V%~^d7{9k|3wWNT<Z^im0HS<I@}!tH<fV1~4JR~MCA1~1zQ@GY
zHoaEZr`76`!XB|Fv3lIFkNC$q*Q9XHYORtBp;1;S^h;y_2q9kuwaidFK`aSrX*=|5
z&pEK)4U={?Pql$yvR<yoJuEb{O)#;;Ql}E-v4!Ao5?#&z3gjLd#F}&-3;tBZPmQfy
zysF2}c$Z1a-@X7!g#Pt2KAz0*qha_d#q`X#sn*!bL{KOQUlEUgDnR4T{R)p^AZ^UG
z7m%h?Ft#eFM5wJ&ha4s((T@|J$G8<I0Sbv(7s6(by}KZQ9yx@$MKTUQ@J0yP84o`b
z?1?SRHshT))+x9zD<W5<!{x$9Lzexr5kTWnKWd=WIJd_b^fiIcdFU7L2g}O{aS|;;
z9vzR7+Qr;^WY~{19uJVKl0N1^FSPqB$RiJoGDK7b8{;TZs4L@KA5#ng(YHexXHsFF
zHiICK#KCqFlO3ja)Hjju2hk9fBom2#M+(QtP;7+H_-!cm`)f8jKL=MWRZ)?E3hzOs
zDgxL3O-lZjAdk>-wc@3VvEzRUG`|(S9fw`6v%L9)VC6+zbJ;fAi}@~;1w3HONFg#g
zC2oYJSc|#$R403KGZ$2XZ!&6li|E=}mD*y_CyahH5~FWU5jhBi7e`#bJc*QI^DI(?
zMfF{J;8Ju1)JS(+S6$v9rJ@)526Qm_*)wr&1Ts6OPq}z8`IA{d_Tnd^Ly^JgXkn=1
zE(w&oE*|{q(##XI0FAux3@!O8>C?VZBSiAE&2|@YvM7wI11HR2Ixa7WkUe>7=tJV9
z#=1Hcf@;1?rB1Qx(ONouVwI2oxP8>=!xEgYQJ!2`3e3OBYAoh|xPAC?)9|0Z`3H;-
z=))9b2Q5F`zM-dp59Ur{)$sx&e`F&BTLdc`Q37m?AFT-Sqp*Rtt<LA~nb{{vhOUD0
z4#X(?cVZM9VF#3D)5n|#-(MaL333X{5ZQN|Tb4_!DUF3&2t#8z=<i5YON|44H?0b-
zEdfg6pJ`ViHoJvl=GnvT|6%K$f+UN&Zqc$`UAFBm+qP}nw$Wu*b=kJfF59+k-~7J+
zKj%K&`>-Q-?8t`|k$dJEYt8|pz7UZ!pL62dY+Gd;W_Z~EvvI6f;{6Jcr4)id=cCiC
z=)&4uTwcHX(-}xa0{-urSj^H?+tZW1i6({0;)agWN2w+5wkmzy5x;vP^(;fl^+sc)
zS&-8Z1u7CRTMSEX(L?@XeiPQ{ilqg_<R`yn%G82M?Pfb|%jlz<YRAa+6w9)TiaJnH
z-a;?x6)LnZXSYznftS7huj5BJW@wS4Tvl|!4dRx$U6BuSO>EjyF5C_9&N4A!>J1H+
z0<AHNps@;8mLV8=CbS-dNDW<@*S+sAaVeU%7C$s$WZ7JX0V<ibImKXfS%&C&o0=|K
zfb(6C){QPe(~PpK+nMLSG_A~=QFgUuJTizJHxi4nFq5V^K>=Wr&R;IiH?J7kZ{Xui
zmmWxheVlycQAdJ{@QDt`{5sNs;uJS{V(U`c-i$+GGPUi${IYfpE^j$lO#|(j8Ypq>
z`^{%I{eN32UCtUb1qDgLy+@Y!46>edsg`j%HnoX`%jd-JNgq-b$tXpgZ(w^Vy)n_P
zNBO)#vlZ}C?)8PX@!ohFBBAP)V|KY;=nNn2!~8Q;2`mFO<c!T_!NQ%;f3LQ16VzqX
zg1*^uY}sCx`fC6k5$j<#`JWD{K$q2ypS-m>h#W%e8zex$@EL;axfUSUq!WX6IWbSs
zm3a8KqEu1?W0zZc*GjAQ6(%o=nsRIExsOhRMXt5zM{R?J`ZU0A4$ayT;5U~q?WSI}
z_6DN^suV+i`Va)GdzNTt9*L^)^?yR)qw1iN*S{}-TIO|zcRs6h5+9D*Wn6s#eUHQk
zG-_Q>e=x7&caC+!Z9vXZrDmdrZ*k}FvbQT1NqgnM)!(BnZtC%qKL<hA6AV^yZfnHn
z-+AvPp_whkkV@ifD|vS&CF#Z;N{qu$n+EVdJw->W#x*lOp~iC5a0&fbTTK>gg*`@@
zmC8hy?hckX>=CTS6lTgocCRtm2Xlwvk)8q3c3K}fq^bDCW`DXO?uFb*wqr18hV=-=
zx|Nz^cR2vZwh1s5Aj=<*Z|{V+L()Ias~w&42rO2!rl0b>^h4KJR8!i$VcJ6@(gRsY
zY>SoGGO>2-iBNa3wMRHTa_Z;rX=u!eWqM89c<|UpGjhZA8iwz(_>w8}sF+_Q*>$G8
zfu_C}VDtQ{;V4ELYYkB+XD$=4KeT_Zl3czpD(T*;;wUDuO?4k^+jZgoimufx-xpc(
zqb9a(cf}}Gqg@$N+r@a6Nwu^vbTlsE;8+PSd{w>G`%7v$NeHJRqzb~cyLIlHlPRXo
zF9gnOJW1Bq5has1b}DKpsZSL{bMYmmGz%70F*p0tft!P{^%vbbICvA8hQ8jefb_&I
z0Al$#>ZKW)otpGYhDQt`+H0oilv8Vv{yLQdc*g8g<<#=<wp{L`SxnkvPT!m7yfG<8
zjX?G~2>0(9`;27-YLQCl#SV*Z$lpC!EUEuJZHL{)T}{Z)h!k_wdsmvIlzkdxpn0aW
z)$w>0yLo?{3RoFln2%)NGGPql@z}j`S=XB`rdy@gS84qYZ2&!`!?4x&nEd!FaZa$<
zb960^<`+?jb=V)X=J$JOQa<*PhgZ&|Y0B_<meI1a=TUbnFx|4X>@ARI>wD4ko`H86
z)A6micgeQNQP+i~;LiqL>rF???X`k*|8gbbX%o)TR?Ianj~Fwhh4UZazSE0}T>07K
zx$|JQ&K2T`4&`W^_3l40SWRmiV{8_Uy7o9tXGMu{P#d(ubYC3gvr~I_zl096M8ARr
za@-U3>R&|xSrzaXLQETh$&Wh@9muo?Tw%<z5%M7XQTG3ebH(4H4v4Z`cii7Qs&|Jv
zGUoPCE^29Dg?SD(QgJ!4>o^+4L?~}%^pm$svHt2f0dETNi6#RR&7$K<R7mF{eUT5-
zVIMo;bS}LMr?zaY(m_rcB(Ks{6A~bGF9|M_dsQm0iB%&nNvWaQs8weYo!`2A&1p}0
z1lm5TMS9ZdZxyu4o#bg;sUwCQePHNI+^VqynWpq>Q*%|aQEowtYcqs%R7_Ho&iuOz
z((=jPD9;gew<^xrw(H*bs$-<b<GNag8|f5BgPEO>%iS6gF!^-nB-aO~ZV7IKLj75W
zxT76U?>!E?bmCDE1|*Hej^b)km~L2bMXoB@jLb`#Ru`VYt&L`OyTWL@Q*@SO+S>2V
zg^H})4L%g@5ZLjM{f@N9G4UuP8631t-e;3SE^e_Y{I#^DaZahqE7Dg`a;9j6@ex+E
zBwL{r0jvUF{Y$qRT`5H<Pn-2OOh?7cIg<ggaHS|a^2etLX^RjOfWsGOC)}8m6xx7&
zKF@iq$&J{ssH>D@-!Mt&w&49P4$xgnzCFpJ-*kw#84R3N37ydnoDMx(<FS^uXB6St
zpuLkH`{sJml7yPe1uUh&vsz;dOLiifJ92Wp-A$b}-rrS?*|kIG@_k56RR80MWjQKT
zgCQtUF<;8Z{i%mzkp*M16V)|6%dXGG{ocSVC5j2=Y|(_>+e!1wz7diEge4adFHK=v
zPFpy)OfFD_ZRAfwc*b~Osmw@_bp4`MV1o|Z{&%_1m<?{mQn~nuO@TnAmKbWbFhU`!
zHRkQi8j17d_(#<dPFXF~mSC`~0>D~=%TxMY%i_<(UAE*}VUSsGS}mI)rN|e%UT962
zH6EI{Y$H+WN|Z&PPCjR;rNmeVA9<Da_m3KVoVo*wMVC_LjsjR-%UwksgPYP!T)Am5
zZWsYrLfy!zR;GH*)j@!i$vxBklKAkyV{hC(lici_xu2KExaGn!o2e+J9fB``7w}^|
z&mVb{@V%Sph>f(FqTrrVm-Ly>EFX7G8U2!6xAHB&M=0)v-JF>Kf$ZjHN_8QmI7d?4
z#-lyUWx{08slDt6S17q1Mhhgt&{tTkR~|Ujq=+gl`2i4{e+!LqaqnY}{nwxB^yWNF
z?@BHe{h;3-%zPMv6N)3y3oAaVeI=@bS3P1EYkjR_mhf1{wE}P1VZMJJf?PSX<YF@%
zn3CRUi-X?6(pqfzrye63iP>x$+L#AGP(QTHL^YtZ!la`HLo+qvSZItE9?!6hZcevt
z6+m@m*IX&(Tr(6PKg!0LV+Jd*`VPL%F&403amAKnF=Aj8UKU~!VVDFKk2NS1IlNtK
zrV12PElrgbPPxL<4EG3*i;4X-M4sw1knM&0X5!m0vY&>d)Xo{iVhU^+0`xv$`vSUV
zlOL(%ftu9ZOosshsk190QF;>r>iYSv3T}1HNbA+MbRpHDvz9$OLa&igt|@;M=<D*O
zaxm)5hT5xJaLj$(zK$cJxZKC66Yg5s<VKhX#EcjVT8R(!M%c&~MTXe_)Khg_7@I5z
z@xmKxV{RG7*jW6-s~XxqjqO{%1X7G%O>7B+46WYFr(d6~VG??!$0CStti;dUzE!}#
z#Fl}pVvbXL?dok*X0Tj9ml7CO?<M<bg=;-Mg+65PC+ekgiPlO0GF0BlU-OjzIh4c#
zbjyL!czZov9~Aw(An5eo9PtNEd^mGIXeUF*BgZy>d@-7U@g0Pgf_a^8XgpwRid{3*
zGa->Bu@0{X;v?$X5D1c;PrqF?<E|<X<w^5kGCj{UcS&FO1M^jtv&sft)n<<a{;Kv7
zG)%O9UCONi%b-k%0IzH|*(eGa9kn9Hq~y^uN9wvhU1H1G<wv>SO+0+9@Mm%*RKUy&
z51;d8i~9EK@&>9#q+(-G<(E&~QhvUl-phaZBhU|iiSK;AUHJZFodtjG&cxOB_<g?i
z7w%dwlvM0^LqHi{@2<lbQ3&doOjP4;kMC9Es;O*^?~TZFac(ZZKFzNVBwJW*WSL52
zXP|;M-k<(4sgOa^`Ky$U36VjNj>f9%b)&*~Ok$nf@(%^h;12@i4e4Lyc_U0oh|R5C
z`g9Wm`0YkUhJp}p?<8DznWYd`Le0)RT*crMJwi>EmI`pY6r4rm<|W1I3y5ulU#1vm
zBL$Hi(d(g4#u}x^JG8$;_5BZ!K8{AGgv+C{jNB{PoxXaW`3-Y?tOl@e_uCi!Ir%sd
zKq?Nku9mDt;!Ei^ISyZ&fwL}efGz~8_%7BJHqQ@+;6>}6BW%e1_Ft_B9g=iqvck8>
z?Vfg9okh->We;X=5Jjwm`$<TFqCa2PCV(sEupR<d0tVZxu#(1b`y?2gd)*2(^C=(?
zlv^M7ZT5K=Sv?&zz%nBXTeop=s|5eqb+c2~_1Ru@TLz;>Y2V0VY%*<n*#prcZFt#R
z)%7`EbSLy<_gBA!trE37Z8!D(=e`64XR~D+2LfHfwwqnH?!n!m&+rq=+y33}Tpa1F
z!tozUvFk~m4yW)u=b8Qe3+rrBMnxJU+ct4>Y1tkbwTD*wO~2-&s;hC5?zYX=kqJA=
zpulc*T!^q&Qe6$cGzOwPqdlz|gEMk;oe%nn8<+en#25@$YZgg33|L~Ws3FP_yIX47
zl>zW1D8%hK&NPkKs18(c{T6<prE*gQX6IE~_%<}Ys(D?0Ha<&}-E8ktg}=gy&8448
ze)zw%=*d)Tw`cFGkNxAXiVmsi<M}tsk?qUNLLP)lOWmDUJP(AH6y@$TmJih=HL*q4
z$#x>i?^#K9HvbcI-6Z}VrsPZo^Hbg}E>syZ_I3<54#dVd<Xho?1W8L$huZNCfId<4
z9T~q_j5l0K@7$I4i0j-^x2a9HVaJnca#2*fh32&_j2pRdy~XmQO2c10#&sdxyMupj
zg~aYhoQF#fAqi_Y<jQSu(GqTu-mdvBS>B^e(sbYnZN?AtgHLxT?{xh$Cze-`mHt}V
zPqe6&+|3>Wjjahxxy#pACLc|1o!ifrR}=^^P88-ul}V@^sf4Ps9!IMbOIo#w`g16s
zDM(5=AR)k{nzyK?*u(FJwvJZ1A&$7ZgZ*Axs&5_7Kay#mQ`R05+I~l!UN$W@u0L4C
z(!ZqT9UIMCkNjw88HE28!N?9MYcy$|f!mLcw&z;wnVn13LS81E#PgFbe!cAhm+xR%
zeZThvZ`tymOlcI_SvRqFZ}4@y^4w49Z`Mc@Q9hmqWGhEU-`DJqj{afq?CkaT70^?j
z7-xWL-a_Z}R%9-o%pN0ESnPDaNtDB7d6GySAu_xWGg3SHR8_h0j{o%kzUUomwUMfj
z{p5bW^N?ze#C0M?Z{q%@Qs7mRi<I@><#>bRAMue|$5-z~Rj|p4?=49?w8}_kk;*b?
zM7+A96oC~c@6Ztf5njj8ov*b-dxHBynPxbPeG56vPLX2&g<Qf)(xsm{J#<o791?W0
z>AUV9Eo*7-yj);6j-?*-{b=81xZnjpVJv?ng*J|A*b0KS#RkxbxHkLZ^*n`FG1};d
zyDQj1_9EENi$d@q?DQ`kJHE=9;tcDk&~VB+Xf|7fVY)0l@gwZ`lr*0)Drg04jP4E3
zzT=1Ya`-;`{D6}^JKdRfLGJjTyQ|*xOBboyP(M(5B9pJsimxOXC0T8gC@i*mv3|zb
zW*!P-(x+D|dGbJ^KCrf;RD4eoI%+!z=miqLQjM28$vz>DqdCeX#-CHDFy%Y9JszZI
zD)sO5K`F6fJ9d_hQ^-p3f%+mw)uYIu=9CJum#6k~t5Qfn^1h!ac=9MNAggI{ps?mP
zvafP~aU<?}r)RNe+=DpzcFl)-X8{jeWgSO{wcF2x(5vhjdwvC3Hp$qcaRg|=_Paou
zu=BL>5&C+#?HK(=ZeSzyQZG-4qBjnmg5^Q<Jv)&(06<iP@k-KkA=3IrXe+qa0_i^Q
z%n<|4BFzPgsUbtx@0wcZ?U|9DC7$A|^O2nIWRba6mE|7xvB9srwP%QJn$zNjfe{NH
z75)D`P;0+`?TsuHyH1FSM}~7rxx6@Pbz)!v&e&3}J`*;oQlSluc&l>vdOLQ-wa=&S
znH|k?W20m=sm|3#nv%&~anF$&EZ7Oe@5<>7x}KJN!$5q%f1;um9)f5B=3O6S1IY3w
zl819B{^R4-ktHgrGOpQNxT(~r;`qB)n)odH2-w`UyGTs9*jcU2#dU^+(R!(s73vs<
zxL;2wnXOs9<0G>>?UB_=S#_kzRt+5aX1w)@>?j2ip_?PvZLW|~)l@C0QDM&IzlQEX
zp65B%t7Qp22tPe=u2g}Q2W(%?=54D{%SpJtWYyQH<>e+mu+xPwkp7I;P6={yW_yo=
zhmTfHxT8spR_GL?njD<pr{YW!cyxk)@EVlP<>dAM9ww=)C*8xB8h}84q4MYd7$7z=
z{?;o2M?hOfhQU))3Pj-_$P~zXJPfbPE1*wje9Jyjm$qup&~EMzNKr!-6Dz|0IFyyc
zI0=aY(b;He1FBPp%N2%jj|J%=x9qW?v~B;)$cDCXISyd~B&Z_>5T07bo|Lk+5rHf8
zbVETY44s-ud2Rv&2S`O|^5EuyBwwC`-t`Hvy!8%oaRY|2_+;zXw2z?G=_{b5Y&#ej
zVKCIH<V?=_jNdE}X)gW0<O@Jtj(yQI%n#H9MZ>=RDku2#dts26q--4u+I4IE(H7r+
z0NSa4LJBrG^|)24j@%V}3$gJEgOPuDa?ki~F0H6yh*|m+0i7LOo{FJ2#~Dr%h^|tm
zhoh_KNXF=|3g{Qzitg50lVL%iRJ1CEhC_w=KY#T!t5|-2dzi#0oZ9AbdlAu~x7b8P
ziP(dB@zI7c91Dun99Sz2^f$6n#7iG}We^FwnFMUv{g)qHuxO3dMXM7cO8To|6x|wO
zMih|XZKd4FqOagG2pxgF){>qLsOrI;W&`rybUJUXl@~j<-)K$E1_s#)I}jAZSYO0x
za4MB!&OaT`zfw1aI9fx1+XE`oN@sGSlY|WLh0IfVzJ&c$@$V%Wb3PC~)+Lyq)<AUy
z`v1QCY_?Vm%D6<U>u@rr9iv#B9Qg>KZw8x3RTQFfQ1}YrZ;DHY1H=gKSptm$SLv|P
zt;M2$C|Yr{U?v2aH|}&3xn?)Kx&G26A$Cf|CZ6_ZL|$m$yu@Db^zQIZU4mY!7)I?K
zF9<GseHphRw=eIblUXGcA{=ZEsP65PmAj8byC~^V!44xp(`Tnyo~28tN%ldHk;cnX
z1hc`OTn#vqaoJ%_$sU+eyMakH%Wh*pT*GO|q3?Ea6Ba`QH4s){+PTPy^;Xx%*`W6g
zx4E;Oi#j<EswIUk{Dvi0{vPk9OVYZ9RswMrU;_Tn*R4sFHP_D4*`BzGqqM1ukltpn
zpKQqLiM_w&F)+-N?tzfqXxvm54_R=T!LpELAr5$h`EE_7TPvyOHrNEYV@bf0wMtpt
z{>3=jI+Tz>-pq$*w2s}A1=}81vaKSe2DAV1-N2myu>;i}#q9=xV5AEd<dApj*bFnu
zq1BvBw1p)h<O6oc|9fKix&zUe{OS*PwIC1M2L1_JAtYa&gbv#VA5vTWT#XG@llqPq
zzJ2k9StqBV11goD*dJPe5Z3|K1`d%IC2f)ctkY*}@bN+H#F>xeKtriK#o~YtJ(!FG
zG{XSn|8B_qm-B(FPhlQ-H3_jVYkT%8$?hk~y3(Y|wrv=h)Yq_+qfK;@>Id!Yx9cxt
zpw<W<biGgqYEN;?+>iJ}!^D|S$hh8~Bji<eCoGpxYGSlnn9GkxGe17(!YhRiE@Ez~
z&TbM+?wx{8a1&kkv<-oj;VbS+wAO&z{pmcZm#)fxS6Vl=d$3#ugH)(}bcETV3ykj`
z;pyzr_lWM3Xexz1E7<}l$L^C~%6hF4SNcmR4mjJ>C>Nc>+syOsfBJFSc39ElZekaE
zl%wvQ^8A`yhuHeH&ksyL3~vuNQ~}oFpRa$Oih?7J*K!FXbgN%dyW#3TuP8O1OuULp
z;ZHq>4-VL@ei26qjSwFPYUmX|#;nlS$yCp@=TRbJVFas7n<!+w1QQIGX=jQlh7l5f
zo0VKu%RK#&!Q4zd$M2m!C49qG5Ik`T6*n^6m`InyVB+1V<hRLc=nkOL@9_a}1;zAa
zH3OstFvlVYH8U79^k+WN=12cF(nNw?lk$1Ki+9ih=`Ok!x^q9dicMst>G@vVN6FI#
zIdZ1AD+jE!*`D#b65yb47J3+kD!h7Q7_!Bo?0%U`x1g^!#Wn(6iV%haU!aiTbFRWj
zB5c2fTht3c^CO5M{{v=MO%y37hmY=#cFAiT_2@4_3CyBCV%FHeCJ-l25QO>}v3x4(
z2#B@V&$ZwiV1~+VevmrOf3X6}R$;<mMrVo}c`s?5qO%uq20~zOhK%$hQ3T7YeJCu7
zb8G?Fw2`Yw&>zrQD{E7Vu5k>b@o}I{NcpTEzut;4|4_T%iM|ubl#wPhYO8QIFe(j-
zhyYO)55>(eO#aSerJQ1k{$R^dHJE~j9ogd!7iI1Az`db{IS3dN<BUZ7iRxaxHg)_R
z_xksZzew%X+{G+C3bJ}cJ8^6iI0`aVa}jH#SiW9E$gI&HUnmMIm4P%5_9DL1d@4{H
zBBS6-Gp;36YK&N!#`L}j4wiA;$%U{$jT&1lkj2_oM$0%LKbxdNuERBRmE78?!K#{0
zizZMydPB3JVdP)3Ab-gav|R)P6sV-nQQJeMEF4{OjCNMMP>cZ~T_Jk0Gp1@J+Bi5)
zC~_q&aod=Zq>T+%hDJS)24edg;c<UeZM9rO{v(er&h~|=QVpU86$M}GqdznetZ(v+
z?1HwTK>{BFooz*vgQG^g0cY;cEfo7b1_%zRH<S&=XZfdTDKT8m><y7g!kTjeLDDBQ
zztx&CB8sGc!`G!`@-O{v@1I_O=~QSu(#ZSDBmQs4hcsgCFp&}ao7SSgw02JS`>lsR
ziSmt%uoEL=`ria^Q=&L;Q^q$aoQolHKSmqn@kza&j36yu5tes(wHulgWsMSI6r~+4
z^8DtBIpi>_#qpI3!-32G4{!;TgCl%piSqiw<F+l~-4{iB5aYyf2Nl)tXPTbWnQ_36
zJo0M`1xVz+&|gz@tSB|khfP!~Osj!BW4p2lVVSuYhy5hXg-}_)fW8neDC<(ZTJ*%U
zE$)u5`r009M2j)9gQiV`cU-`<+0h_Sb0x~H+H6=A635ik%ul|0dpqTS>`#g&iFe0Y
zefgh~P{y$KQ<_f+@{1$G_e1sgW(n=s&gzb{zrl)liaC2GH5n-n)5MD6Yu8(vx2tH`
ze@m}qCf5^MYFP77A++Ze5-yU`{8Uj20Pu-CM4`ul@?68$S)OGY8QtJn!k7cL(WA@s
zwO$&A0aq021j{s(aS5jrd}?SoW2K@K$qEf*@S1TZ=f@x`j$13YOeMk`<wts*!O>P~
zM7bgASj2>5QX|4XadLtlaEy3g6Ck|<=*E&m{}=oDrX#jB^d8Y|j^0}x^4SFZtg~GT
zOz~bTIoIRQX#oKy9*M83sV*cwUPhPam(b{x#NF1k(qc)QC5&Q_CsKZeVb+snGN~O;
zKAS~3Y^Y9la{6n%ul=%0*Yc(*cZ<)tnRu?ie5CCb=RKrj4qH0Gl1<N%Agc<G2EIk6
z#&`;7p#fsWwP-Z&_^G!j?q&TDrZ<v9r@H9Yb)dIxocZf2O(EEe$m16N#6%OtDA3i?
zo6WO`RXQ*7XA6Z8$IE#Yx_5tbZ>!Fwsw4@U1^n(`0tD;+{iqE$PK^(Vp?{2mrWeQ5
zj$;Ngb`?WUsR@e;EGQJcbf6jIu>J2-UmspGeVOg>p8n&3N7Q`V4cXW_PKnwf=T*T8
zlPx0r;*km28One6k45DywQkMPdLeO?t=Wi`Q?yL~-ov=S*mwTpO41i=VsmTNVq4e`
zK|DEke|Wqt`j5T_hJWay@?WbuP5buD$@|H_NgiE1G*GOpIB<3XvsC#UoLbNg9@H8y
z`%cKhcT@Wlz%)VhD84l7Bcl1)@kTH98pGx40>s)lZo73u+z?9k!aWCE>n6QcDyEs=
zHKS~vB6Eds+UVz)S(g7Xu`_Y*O1*v<brpson8IQq!yf)E+4sX&=6b4t5Gv`*xubO9
z{7#fZf5;CRh8~rH`DV~}%GXa{d05)_>UZw>$YNEEf5dPJ_Va}ma7CLSll3k<RY8xA
z=+jrw{}r>qm}>t2h*|cCWr9A@l2yu@Ko4QOXcS<BfO#*-v^pzOr8ddU&CPyAmxLw;
zP5#BABFIwzCF^BMm03`6#J1dk)(W~^;lO@2u7`Bw0=-=&6$r%ja_*|=ekFIVx#6Fe
zx~F^RZT>oJchgOSYs6k*$aCl5%X4Ri?9|&zkV~$zI1}|*N9;p?#_Zz$vV;(fu)^aZ
zpb7D<ZL&8?`B`+3qcoHF6kg$7@pCD`wfG-hi_1>M?dBS)R;B{ybGb(BSJ!HB5*At~
ziYJC?<ihSLk#!o3=@Ght8Cn$0mcRsEdn+ufax#6e-BDzjFR|1kJ28iDjF#r9F)s-<
z=>+t}O~_4PH!iIMhx`GVc6St8ktceGvOH7$o?BUB+Eisq7QXR@xnXQ~nY)7!TNVR`
zgI0*WI<MNeCRP?NKTRT^c#ZhcCL|>*O_b>O;ceaJCm}Tse|pJ-Fa{RU&s)!2t2*7?
zG!)gmXpCA=xtn^1hyvvH@-H9p8p0^HNzYkSL{tMJc-s5&fJB``un_BVS^x}xH_wTi
zcIEES6Hbk#it`Avzmdf^GwGRxo%^*I1467oVH#3dQ2xJchm7!ZoSf}$?{8pa$0nkL
zmId#ZUjv7#%<z&5tda%UYJth~qHW@z6<8h&8dlPdrSX|?hoi~AsM_<bLs4SarHAxs
z|9!jL@SqUip7DS^g*H`t1Beb*H3hYh1q}GQD8kW(NNCkLzgP+I<C8ct{r;0q_}_j=
zVUS1#I({_z^jBQPxIRJr%A&_Dtk6`F==3Uiu}{(%sRdok%T=UV6<Rso`L_Ic9{A0p
z%-tP@gznZCoH`5~WwM(^>xbXnUVo;d550PRzVIr>4lSV+)PC6b-*;pU3-KKtT;H$5
z)4L>be?E`b*E@f=W$>jqVSYsY=i=EkcAR2M?FmH94*mbq2dtfmb$iD-XyrBj#|>R;
z>_2YkLOFKl3y9yYuZ?EfsHWQ$?#ouS)c*E=q!(*`%c!b`@=={*v5U9Mm78TZ7D7Pp
zghRe$EwD%sA*c8+pOV-PuQ&NeumS8bHRN19nql4MqQg{L=5j@v6WhUzRWD2;wsnoD
zvn3LjmX|vJtHfCBwD#3z`t?6bjNf>?R<i|`c~odm;{w)dmyY)yH>+FNeVxy`R~6m#
zUd)QNy`v65Gvy;rNC4`9+C;{JhB|;cfYQ7oW?{`oZMWl(^Y&3XmfXG<p}}&9S_Dl!
zUXE1or!UBMwGm&(2Zd!hb$Gj1Ej+q;|6dQT0|WCZA*2kI0l;OFj=w1En?2hV!CF_;
z#p$*ckeOFZRWM9_g&cY%dSBMu7V#}mg+f|9dwR_-=yAkwuwUKAV^-8?6rLeI7R}gh
zRv#`Ng*V|4CtFC@n5&)bFyf|gPXvb{Gf^$0hEJpMz@$lzMB$1D0eOga%9>k{eIBK9
zQAmq2N(x<WC8Ns1l`l<@Q}+_w8(33m^;_!oMCySq2`)e%>pxAK`Yd5g0q<X23;C8r
ztTmKP=8an61JzrPxs1o<)7o62FWS*vo*lDGctr>KUy%P%W6)ACh?gq_bxFFDD#_bo
z7<IZakXMljCd!f8Xr{+nQFzwcx2`LDnbeio(Y?I2ne6ee!2IZ&?$wg|6x_G9uBtwk
z&N6lmj9emtkOK>fgM$y1-5#LoZu6se3`hNM;N7@r-uW|R$|{Tx8uvpXyCn^!Z_kpY
z4j}H1rcB|?4q80VwnDxGj$1$#%AHCGWu?|-g>TV3*XnT`mY3_08e1-;E>py)w|{qC
z0#~qjylON}T}^mPazKRJOS!{QXCT;xN3azz_~ICkPP)IyqTOC1|C!(F6D;Phlkzo4
zcovXY7)vl+2Av8exiY9+1UK4#DRpS1SHdg?sfs;Xs<MQ;d7{(?w;2{vI2@xbQiji*
z3%U7GT_n}X=Z-xXdsxStpJ^V^(=4YhK~@rMe;m}RkBJwdgIAj+=TeGwwK=4N)!bjd
zS9i|gIUwWOm=(ioeQwb0)e+oo3YGM^mN!qzeRZ~lnTb)s&UjuPJOX1^F8&F#{OMz7
zwNN%{X4b;ZZ6EW-W+^mlbtHP)*}1y?h>v$PELF2u&DDf5(<4Nu2;n{VJ}YJo2;<Z}
z{>PhHKUMpcctt(c2RyUPiHP#WL`%-E5F1=!$oEDheUfr(gj{fY5c5?gT^5y`0dFb$
zRC;<I7Hw^KA!A^T0GeQWV<maTN3J3(Y&><a%uYiMH+*cT=x$=Bci3TW>S&#d##-YK
z#H)V}9>ZA)K@*la+i>ZKl*~Epzo!lEH9ih;i>j{1AzStiOzq$N&>+B6iFFtdl~^Vy
z?TJvLizF}~)9>t&fG<4TzoCSixi%z(N*N8i)lgq-%tgG_#J)Z}SQMs!HA&Uh<kUoK
zFoZIQ2*oU!KxgWFk)ALz9eyT}nLy%f$>RA0-o&3}0<Uyq5Q^LZ2^7?Z&ILsiYi6Aj
z4w0p~NgP_HScOS$`7g{sg$Jl<B;S$+&vqrO%Yx@){4mIfmvee<9-r=Hl<=swSlE)*
z7~$Z;0KD?HtOQTJ<gKr0u4W|9B4D^U&H%!QhoZ`$d>!_LlOI|jMv&u?@o&7M5E1sa
zX<30(S6iuDW2+E|#Sz{TQye{*P#>Y@b=!NfXr$K7QuD`B@e@s2U?ie-H#zkHr|Cl&
z*)Zw1c24)qnsgwkj&x?VkbzwhU<iVE3wb#g1C(0xp!4$edy}NNabDIrDszSiA(}v{
zG{`MEUjGRUC0U1o#c@=K-3V#;c2|L!)y_u`oqm8A<+wtO>^hg|2@xtT+K}Snu1$b7
zr7_f3zc{yeacc4!5I*<EL{F_rU-%GjO@i#<`Ny<F8%bG>Eg-k8A!xZvY?=@<`FBOX
z1xCi{%$~DrtHQi}PAB+GxVC%r(G0ofLq?l6n6~{E9W|p}N#WHxH7GdM)tr+boRZxZ
zUB^!Ab?VIWR#5utQ^q>E*j&4I$dEr4`i{8ebWK;y%vlgoVb<!Vgk!stT%BtNP=d}$
z$4#kYHa(2+*6+V%<(u!?$+>^NQx{n9+<3PEA1Sq=ep_Jj(S9OTh`7BC1>F@y7b9YD
z8SY;U^AkonH4R*T^W!jFS=j8}xC-~B5QS7G1-#)ii-S&HEso!4zaj0qX;J|%#^lMK
zE|sR&g|=d#At;`0u9^lB2Uc9_wQ;=Th5FoA&r_vOjUU>OmVOqUtr6-U_2T45m4r}V
zYv1o*U~iiuM-Wl}Qf7LK8OW^6M=b}gJe9b_+AOIR7uuc*Dfw}}C`%w`7Gr;DNgqiD
z&SdRMX`0nL`VwiTq5*P7kZ&yNAzHSRE2`GBj0}X!`TW)aD@MiU^v6|jDuXC|GcMo*
ztT<PQs@D+#jR)0^mm09*L%@m^k!8AF%gg$j{=~NE($FFo<%vhXGC{SwR-F3naH;aC
zmr6Oy))+0>?_2Hs{sB4^)VdQfCik#C>{l*1;6vTu;z7E)=Dzr_#I2QDA!e@z`t@SJ
zMLj;_YloH&E$gAi(6O3fx0%$KZtxW~;E6lA9Y!=cF9BC-h&6eRk*RPIDb*Pxz-5%@
zk~BkpfHQ2C%6w#=FN4Z}R-HH)N`{A6J6<K&o!(B%^kmv~r<V5S0o>g(E*h*8u+iMC
ztL-b=X)W!oyKJgk9&0wDtqN7`(^=IrAr+>rsg{|foF-blI0;!xeTMuxVi`3Ivr!Xu
zRdGtQu8YRyA9&R;%XpIxTj)68d;wc1HhFp4SB>xn4sx|x$7AifuMR&M4l1c0c2!!&
zE#G|NE0fcK)bl{cQr>^n)_|>%{A<s32Q^U1bFaFySI|fOZsZkiH2b(DW6cR~eT_y;
zh0nFoQHJ!mGdJmaGkbTM!p_o2B^Qw6gc{+o1o~DYPPX`N-d)UrZKkwL6<8*R*p0Kz
zeD1BP7Z}2kZ_9ITY@@gH4prLF`ns!VOv#!*4L5Tmk+LhOYT+Nn!2{6IgM9p79ev3u
zcctSp1?4LE%J-sf;FGZbAN7pPI5R3redU6i7+pp4s<e%XQU$c6qp5-bxse_Xgne1A
zdJo)f-wXSuHz(v0vnR}ycuH#QMSI=y8WPG9MwH7^a!FSSpCpVufcB^GLL~o?65Fm9
z!}F2C<Ll`=!AQz0$F9mxKjYTsWof-@z3?1KqW>RV_OHS#q!J$xX~o}I(l&7|UPIEC
z_Nu4YJM`APGh7}T4KRHTLwZo^8Zy14E*ur=f8TH)t>6^hJz4QbFFbL28cD+*P~O*;
z&s`;0T6sNy>{}{wY^y6&bkwgec^R&+t|U6$PUaT=^5$biTmfyXg_!5N{|_@;?=I-X
z5-84n-tBB(<($n7p|CBi0x~R1w@lO0>W<6No`m4{461r){LI(0+d!xx1El|K7Y!X6
z>ci#_1P9Hs2ajTj)PtzSaH2vD&$Eg*!#Q4d{M7NpF!7WZFVO!>#(sPg;-SXp7brhR
z7TJCiRAHOe<9A6wzR$hE@wLVesLthXRa02M8PS^*B2JJ0^&QSgp~Fo`m>rP|7J?;p
zNG*LL!XqsH8Rz#4RJ{+jcE4R+EfYJ@Q11{73FW4LfbySeW`fZ%M!^>)m6FzO=CjlW
z=P997u`2qvFV>ObjP#XCG;yy&O!-_wXqP1#=lPx}=iUrrIB+{0(Q3tK)_zshx{s7*
zlk;rm$qU}(LYIeHxASKByQL7dp;X9PgSh4CD7%5t5UKXOs`x!X>kVwkOjm1n2kAAT
zjIEWQlPce6!9~KtPq8l%resl{cfdkSH;tcs`d!2`a4R?Si$HVa;o6)do-I$|{A}y`
zBdrdyvG{fJL_V}Z0|P?GV8g31F9v6z->p4?55)KR|H}+UI4~pfj(#)MDtn>zWKh5c
zdAd&xy)nI{AaH7qO)cWJ4pHHwxjSrC1Wo-({*E_g+;UzUJm$A{!&59dfxfY#q52<C
z|0o6k^@)_{STFPdP!FEnNMS|hL(rn1hF8Q8G0tzj7~0Zd^Gm7%Vfw$AUZMro&GFBF
zFuf}P(=ULfsYaVc#OfGPU)ql`U!4C#eEWFR#cN;w^MCljlWTJa5OkSr=}P4_Hg#sh
z_#dm@7~gW?U>+-GKQ-$r%Sq)==j}y@!TPd=N6}{|7geT#?C2T4JDWYOmQFUJA`_qF
z=Q(Z4KW36*>|Ac;m3Sq8sHn|~C@DlFxIwJj4BNb%`K5-snui;&yjSKcmv<Z>xZo=O
z=(`knEot3lHrti+*wHZ+xQD1W6ep8x(NRLxewylZp{?8|EUMY?0w%8gdSJy<xKu3-
z$H>72ezmC+es+$-SQ}cB@hBZf35bSmgt8~bQ%fO<y=`kGNNTcn^JJ#+>E|kYzhn5q
z@)pH_wegF1xUan0G6~kjBt%)9eB7k`5K_LIygut<2NKEzQn<N#<bI|>U-2#8!@8HM
zu>=XOZS_!K%`+LWpA&c=+7v?Lj-Fu6>}M@!BKiVfmECy!1l$ILFF@zR&0jpV{?08I
zSsn1yc2mQD)02Z$G^WVyeWm`hd*AG|%6A#62k?%cx42sG$hQ(Cc$@KDuhzTM>r%la
zsr?%x5NKf+6t75cp03oeg=S(a%C&FyeRS^C_*U$WddIcf6K^BOPqvKI=W+);PNhH^
zX%N!E*l4LKcZVJQV)HspFOLdVAHX2;=tan6l0}ZV)V;lF*{{Fz<SnHcx*wOYQ~_{b
z8jx;ncO`BhQ5NR|$L$G#`(<>I7wVVuW;4jfH(O9sYHBG=wot15&m*@0TNNgIj<gN$
z^!u1FVTNhKJ8!ny3K`cjR`O}1jYXpB_bU8IsOn`$!Qm>@dK#IK8%WmA5nn^<9&_I7
za{$E<0+t+QJL}!iM^YBzA39hB&lgGT{eID>lx17xAH$XHrmYa`Ve1YRovmN!jXnHR
zLUxAFOAQ^Ud1f-kBl%`1<p38wiucDT{r=vJWc+_)mVBNW=t;(VT+2>X_3~;k_c$qP
zFpsod#8K1vCj@2B80jTD&vv|(!J3p+gl6@1K}JDwjhrj+F0J>4KuO<2S?U<Q-S!we
z-7@V-uVQTx<s&j@!k;|yrN}xLC*;k2hr1ht!|qx&%Pb5)R@DtbY!@l28gH54vsK#9
zjh3&kc|dAiTGv7K4}*yte~YDS(@%H6<5w&$94v>DN>5iCH{jAn$fX8IC7Gcie4I#c
z%8RbTb;hUOV7A}Jhm;h)#=}LN-<`S-L1u5$U^6Nwntj`2y;yrkTAZbRWMx~ph=DQh
zIbt0X4BEbqi6;TNoxihqBgF*EQJ4-(>l&S~y5+P(qdHCPIKNR~S@)I1B<MsExXh_K
z@+c0ty6Mi2D*6qIH`}C-5hO~)L}26?hbPh6xCuY&E;_6Swveo^{x<1bm7|V4lZhI7
zy82N%i<}m+CfqC3Tjd$&IA3Szza|k37;#w_|6z@!&^f6p@>*NoVo#+>S|ra@lPydz
zC}vIlH=$AjdAh0=QFn|NlUPCT_JI_@rUX_spn*Kgs&yDGT07{2g~4g4QvAbDBB0vv
z)0;TqbJv^uJ?D8B`#r7({BU#G^+PdGf^4vU3YKS!3%uMC8}PKs0|M6)2lPAR(uN4Q
zhAjbTh?0>cUTGsrRll^w7XdO3bvz4}3*1d9y!nr^rilXv|A?$EkW^ZNVCM=<->lZQ
zw5}3RXM{j~LkXFzqGL0N4GQo9$GpmrjF@yu&_!LctLaF+F&2#*Qv-~VPut~LRoT)s
z{e>|G%WaFCoc>=KJ>9#-Og32U^13JFOj~8}3#4BCbp&{UVqs{-d*V#-;lsBZ#-wGZ
zm|$2bp!0BOGXX!MO-kk@`yS+f$FWc#ZN$*C$=v~jrPu~9zL?}>Z`sh41`!CWVAhU+
z>#GjBauGdib{=nnlbA^caWgN~UT*O3nKYO7VItiuV_#e6k^#CJb)6bc)^3#un_)M#
zDQZk-HVkg$Rf!LqVHx#0*u|W-S{>Q1_0b}Tm=j6(WnEwmkMhOYTV2*BzL*;+_#K}E
zrI|7~*ZxGbst>@gQ+Oi{kA6@mI3~ni)vrrt03$d7@0JaV*5AWxebfz4EBh*s(c6{&
ziH+9CW>sT7A~k3qOa{6>#U5V&SS+|cPpE6Do2eu%UvLb+Mget_(V!CdXJ`uRJx#jX
z@^Vl*>gV&B`Qy5^$We=x=J;+}oz0I2>$2S{uYfHo)6H8dGc*8wS7d+hd@X%E<EYG5
zyy}UpV?A296>b6l+0z~?)=vy8%oZp3Gmd%njo4I!btNkq#kyfB&8L1QtIQzVGuU>l
z$KJBzR7~c6pB&-mK8qc8Z~Q0eBYMaGq30ttbYkHLcxs>fUi;oQVXimm#$e*}IsQ8s
zAmgAL*opS#kF80faP&}}eRt!wZ#RB$Lxf%R6ZKaxd;H!t!Tt?~@a#$<6%u?SClHK@
zw;{!#7=J=5y~i0g_n~v^_Te20i^5)cn##Jlz)&lt7eX-T@z~Rj;e#T4!26XeU<KAO
zAwNp-+GM5mDBEfK{2fzaus{qacEe4HbB*<6jX%lZ*K3+=qTgHUEaBG><X70Rm*bcF
z(-YxAxOmDNuDWpE1O4}qn$!-w8^aK#ukDNgn$-DpaDRyytd^CNlV8}7h$8;>0coG1
ztlj06A>0#dl^2+#f2O2y@ZSH^Gy#7-Utj8K@IU0yHCfO*;U2}gpQDe|=zO!vsMTMs
zls1L?a1Oa0?Q+!}K({r9LW7s8&prV+E;ha8-7|~x^mXa>fLQtT!G8WIKqP}$=m6qT
z<nIz}5J+QWmY`+nQL}zRK(rKxya3+m!XMVDAg4f$wu`2W6>EXJO2;U`<kAdz>Y${>
z#a%IGK{LM}`^`G`4oEvAfOvDIvexC(#nF+?Q<jr*a?O^uElJyWXOnkob(X$j)eMYp
z2)DEvME+RDhc&Wqp9xq;bfF0Lw(Z_N6j@o<#)@M;CYU0beIp9xN=dh_1skbS11NPF
zsD^Uyqs)tu-&6_Is)+;lQrzNlQ$gUP5#JJ)y(S!kJKYu@Cx3K&zu-|rQ3NcWN={gw
zY16QF>W<zyjD1_KVLga6m0M3ht2X)(Q)6dD+_ISrc~m@XydwoR5k8|Uvw=MT^!_4d
z8rKjQ4~Y&=hfKF!91k<7GVRua(J2vvs4|rv7Bg$B=gp47d`f_(=}1wnK7nUmQubht
zMBA;8;k+Rz75I;IM)1*Iv?BNrl8ljWDG8c-ORE<`d6l)Jf{|JAk}VY52=X$c5Yoy#
z;eAeQU4<j+%P!vl2eVV7;YgT`1f{UVO4!zP&0iVVxj}@}9ClCxhKAz5r-HD5nV>$E
z6)Baz*`kb&BH3ZT1hS&Vsl6vrvc-SOlzjDy2nIr~ZSJ39sQVKvYndfg&z$}<CYG@t
zDwIhgs>c5BSa{fyo!E12Wem=;){A8tXInXmFTg@thR)iVa4S`FX!iUe5<?LQ|2_H?
zNeKbpsgq^JtpXW){V7I6^IetpUl8Bf2#a4aCmXYLdP#*Eb}qUL>9oqlM|p0xMC9=q
zNTF;Z9NDlJSvtf^3#uCTcn~%~>Hy<01gf%|Zj|ZG%(^Y`*x-PSo=_L@n_A%quH63=
zr|Z|DU7Oqr>LJ3C%H7rFN0iXUg3h)(J3|wmClhiU7|j)uc9cj6tNzBw@`}rxl5D_}
z>!zw+e=~w@smfAF%YyzIh{ykQLFNbSKsV{=JFu&{5G<J6b&c@69MPCyCZVbTk3B%z
zO(%BgLt@CIfELLag6B%W`erlX9uwQ31_Uu=Y<<W$Vt=DCCCw$4FNQ~<(;5%ci>V35
zAfBuMG60|5ji4M_HCCle0sdV$*t>SDIzSl7K*_+@@2hUsn?O2upmi~}?gNMh5h#Ga
zdP%?qUJqTVf{|7C$F?=>$tp>f(awR|fwU!Sdo3hi%L27Z++MRkRY5JBQnwGk(xtzH
z256!%jXuU#9JTK|hde+L@jQr(M&reBio5I}n_eSk5P}T0xemfTC14bs?aKfMZDU(t
z%5_ZR?Af;NkiYZnm@&2Ew}d8k5p}h+;y_qS<zMqtfv558_Ig+c3_w`hHGCVd?39oc
ztON0#1D>r6{FKvT3&}FTqMdnT)_1Te!FL-cyf9ZW%rI+|@TU;Ytw#b&ZR!bPYADm{
zx%8VF(|rBf%g5V#Pz^jwC}Zv;xVpKt*PN<LhTAI+*t(^3hP_rlW}9fU<O~{TB(!SX
z1)XmBmmdR{j`M5x;??@#O%~s~Yxs_O#T{M9j=Ht^)ZR<M&VL?MT3!KePd1=?YrT7u
z_Fk%GO>zA62Z0c4v)orIU;}JlyRm53TZ|AOG3Zh3X|XqMz3Dh`J@aaCYzA*S4XmWy
zl}9-K;^6wtcnrkAuZ8XSx9q)KcY}DyD7%zX$!fnvblAc|5fOvBb%3vq{#!9vNjn`&
z3==*z7v#>WZ<~kP8D(=8dJw0ZM?V2weI5Vh&h3)LnNPog+7`QrPn!C{!$MJnG-v3D
z&nxu}w)_lnEZ@fh?q`{X)?{O$GmA?*^Blv)6J{_E;=on!Z2E2c4W@@_xkemeZ8^7o
zBCk+owK-(_K%pVRr4fPeo6N5Cm=`*Y3ATMKuaJz-;14ptM_8jzbx%Rr3?dS36r?!;
zTJA31KxwetKnVNJ2cGlAe?ki*uwe@ls<x&rljq=7GFU_5J8+gk?FsVLk+}$6YMzzN
zAt>KpVfY)Ss>yeV83BIT!xmjzA4nXQ33wT!TivsLgUxc_Ow)fnWPxSm(WRh|c$Hkb
zuKl;|?>&yZu|qc^uTwIM|G=#}*;Ir2S;vnCxSF6*i)bhT+hb<TKjJ`ef5!yeBcg9{
zTol(vsDci}l#yAm=rpA~KcmetY0Q|IVT@cjDA;JMnsZToGr>L+)hbM^i0#dyz_Ri|
z+6cjBMb1fx1%v3!fNEBOSBu3R`VkBw8dkup&j6Pw02!&kX4T2Y8o*yH;b$3aE~@NG
z*s$|9LJK!flWW9nHw4k;SIJ3q1n{z)1-YsNrJhjhVtzo-1$@zI0Tn(kfJ>{@T@Plu
zE10wD)?tRjOQDY&z+b}vD??)E)W}NxAtX8O(5Y&AW7D|L*-~-Flvc$qqJ&pUS}rCf
zLM3t0F<D)N81QJXmx@qWUM~^0=({>ILwC{)K#dHyHZ?vsNd=@o)-P+Hnvo)GQ9a_U
zoOG*lc%hhLw&=p$Gmaaa*d`k;;npsRR9Tw&JJbd_l3&GA2wB)Ij2js1<k9rhx`tk+
zZJmKW%L^=EwvS4AYYGPeEfT6H;N|UQ>p9y237$NeLr{9_IqL;9tgxDcBTcw&aRQI~
z*^`k7EWPMXLK04_*wO=B+c|!3WoM}A0@*kNr}r1w(i}V7Y7pOz6x2_F=Yc~a^6#to
zW<lq{mbARr24R*uIX?ga@uxcyZO{Vc+M)vqa=WNF!$+Xe0!do~sVCq1+6a$j@mnRd
z+}02aPdU7tv;-cyYPy0k*gYhyUNypzgmYh)0aTLvqxox7(fH!dAbxadXuq?~b^38>
z<Ah?k2*NZ_X1MVj+U`HtoU$>*)&-&V0l{s{2?twGF<C9Pn;h@wt)a7XV$J&@2wIyl
zf}6IJZ3T}OOb2ry#@SwTK}+mZKoP0b+)hl%M(!kXxb<$}lC$Ac9$`P(g+tuHBjj_T
zDB9h`(!nkp-4%G-=GY|P|1od%;uYL)N~M;<<*Ox^$!_TybKF;PA;NAE3`%K1T>UL$
zUih^B*xZ8>ooWJ7Rohc@-%)8>#zAJ~U&Zm2@Zk5>0selv*rW(k*JF0>)9li{BKZd$
z2l98uW=#}AH+~c*xEWYW;6B?0ZY%r5F0Drlc?8g64t?;P9$23OV9)SxgX$H;;I!=`
z<na5SJ)<=FBp4mnc$iL1P7n_9q!h4cxVaR>p|xr(Ni9`{PiA4!#V%!7IS4}MMJ{XO
zGfWpWGz%U)|M$#bfWc-rOvem2_nB!x2a{z`jmBn}!exZo;&`xJr)Sy#J%T3(9y{cw
z%$>!k0&N@gbV^6FiZXugQv|z;nnbVR4sPICF&|oQuMM)g(+0+9C8S$t0)D|)<q7Gk
zwg4XOxSD5@kGZ^CgUslgclN$s)OQDARs%aC)d~RnFKe=F;q}SIf)(?GqL#W=D9lb>
zXN-do0qSOxe^fWy%39!Y?fb5%%+Z7XTMm_`#?+?&Qx4vz7UT$9)NtB>a!}{+LI;$C
zKHNPApd5Sw<-k+BB3cz`=AR8H2eYf#(b(2!D^(ZDq9}sS&iiI#Rri@y?H6Nr%sMsi
zj-t?!Yx|6+Fr_%G>g~CVWaLE>$fIbvC*TWX@iFP{2DcSVik-)aT26(Y%>5_varJ2P
z?)>|L4c5`|XuB1BS_ZD36pOcxhfYlTonNgR0dLq49!^_bZT~40(BmnCxfV2Mjy9_V
z597I2h)L`IJqu9hMgttC9dKpsOdO_>vCYkR&k<xZlYeYxemE>U;6vEx0e~?djnpe&
z3)90CL9>MRYf6Hl+rQ`#HNgi{(yn#`G~HT;@+}`Yu))8a8`;b+A@n3K1d)4u6J>Ag
z4qH1u4xD2Dc&wcsjE?VO0`w<M!SPP8(ikBplnD#B!->*{9^}lqYd(AaWS)d3j35QI
zrHaM7E_NA79vs`^u*LO)+Y`ArDfURT2d8ov$GhWj)Kc<l?eaMP%IZim3r-bJ4pWl<
z75EIFVn{iBEw;;J_5`zE5VwAZ`@<<d-FqgYn-zi~<?sYU2fu79Ug_qOtA5HeIfS_A
z^g1?UZs^YEH8(unM9V{atlsPAAh|mUy&HB5a}PpiRUHjmzg}6@3>ov45n8Vw5|~cY
ztryl&Xz7aK{NzrrJIwiAW8zD}Ok3^&)yit-LiK2L+|aY@H4BrvY$=p=e{f1*xNzF6
zVYX3RuZw+NuvOfD`un&+p?Dgri?ZVDn1Zi*HKlILp{4SiO)Z5SG-D!DiF)aPj@sF*
z=PGfXz8u@mR5I|xsEU>BOk*e5d0-bYe)GH_XN@etxOQCDNGotv5@Q;@kX<l_sx-#-
z$S1xXrtBrm^Z#k<9fLH79<ATDZDZQDHEnlK+qP{@+qP}nwr$&XPvbuSbIyC~J-2RB
zm84S1{+7zFz1I4zO1$@CzwAzV3z9B#I6<oB?FY)Qy+<ecsyk=mAdS6k;FhL{`*Uqu
zrsUdmmjA*LM`Eu0%AA<_7k#i#z>k}lOiVw{+O4(H{IU=cuTx@y_c3B+hjOc1FS$cX
zo;2Ghe$vwtx6_c1vt^sCzV)KXBH!$zY4o6+sn^O|4AGj2JJZ?lGSSzu9-CVia1Lum
zLc)@_)Un+k28+y(h;W2vG~<CP(5^|VPzR~<S};t&7WERrxdwZh^!S>m_VPo1<yJTJ
z>fUvwi+#{e5kUW{o_C&u2i2|yNq!UlyPpraqm?4y{N-Y=rF(B<SBqYR<ehbTV1y8r
zGF4j|J~eoQP^6!BLLf=>!Y_ib5_SQ%;}gyoG4z;X{b4h>G-PH#n3Mp!>#ha15|~C;
z{X>lyFGa;|-c~IYXQPsaSvvvOz-C_7rn3R8%H1S=YbY=!Wtlh%7Mi~_xLFFaRb4|%
zrykr&*S*-!QFOAp>AMA14qnwFXG7XXN2chb>a8pTs+NEFqOgpDF#RR58wKwxYJ<~?
zO(xG94wlsCHAYo7b)A(L-qp=FyhJ0TRBgDwcK<lvyQovV2zOPb{;^^4gZGmR|9M7D
z?|inXH2MG!KJ(<cTKpK$2%*%ww#_w_nyTWN`Wc5H`d#;L+5hv@qE6fup}g!1OK_>r
zAn}(2_j9ExY1IFw4n=&-sLgF{$$wrla_Wk_?>ijo;{n)0&ZLe12hGf4`oGZ3zRdd_
zTb_P69a|f@9hbEU^Z>q4>9|?FpHq4Xp=Wwoi3r;z!@{MxC)A@CdTFksC_d96KKlw|
zaD&}Xhna2n{{?2=g9%gTEge_!#4hc<6~>$A_ZzV2<po;z%Q2pJ9$}WNI8v5hw4>^u
zV8X}W8eRHSiBcUyM<>%&Yk)BSn>HrFn4iID*fV4I@GFb()WbQO(p5=x@cUQ7$lKoc
zeD2Hb;!g}3DrykYUM7Ij?6q?tVh*4*L#+H4rP<Z?|3his=i9*fK&r=*ysd`OQDTN-
z2y>kH<RH0`Y{t36aJ`3h2&661L*dSfl?sMC$y2im>zK4soIU#nT^>+`p5E_zicn0H
z4F?$7xJcKg5G&s&iusaI`a<1l!2ojAZw>hW*U#4B=$A_7z09}m=2q1GuWKqyb-%rl
zq6xH~>T2;>^18w>_2IYjmDG_=5}90J;b@gk2WK))O!^>YO_Glk^!jFSMsf)+v25#u
z$Pzy?*#|B%tjPa%v%wDPB4BW4mEJe}z?iVj8oFIlk(1hmQhTg-dDfmQZ2DjTZA5xP
zQW!VBI|7q)_UJsTQ<<4qzkF6ne8@@g{g;NNp+NgU5gKZ83aPOE*3X(v*f9q6KKmNo
z(`^~<CMFS2e?V*rv+YN7jhE4$7A#Wt3tFRjWK%emV+avs%#^s-96E6JL`EA~fa2JP
z3B+&N1(DlFi76@APfyH4xlZ)DdweizD%C?!>RpWEnG+@q3y-QW5M8#|<DOP~=v-Fs
z!|ry6@8_>QT}YSQVH{s28W?(uLi7ayu>7v{AHec3?F5aY3(~K=jd(&OO37wzN15X{
z_+}hO#d61^|Bl*mI0wf|HTaJ56EupOK}+Cm;QpXd(%X3<BJ4rNB+Sk!RTk_BGdZ#=
zuG##btX*ApG+TV)*R8tOv#-oh$W(kdeX3~2bsyfpsE~*n0{l3=fp;==BY6pe5$99V
z;$X3$9!bj9q_>4yenL90BWit?0dtf<o8O<qAfB0x80g)6{6zmj0|9l7a5VcJ!qZIb
zbh>!}9hMD>IHf(^=qE4Amjc?#Xsf39BG_}a1jyG>#?odNOz`3W{G`d9Ge&=tx8aeI
zfDhI{G6;E3J_ZKq#D|@{h|;qly`tZ<#e}0AO`Smx`Avof!^j<oiq<Lhxy#$y#Z1k0
z>id&O-=Zp>)V<15f%;nDsDHlC7-_#$`SkM4V-h~Ioc!g``VgkhV4+O&MCTMp_X*M?
z#`#XTp9zc-DrvJD3xJoQ1D=$A0YKr`T_wuMT6YMN>DEfmSQ1^J==lUDcLCoX*e66j
znpR!w1OHSbKWhx+r<z_9AF5V(_>{aqB|Y*70#V^WVT#i?uY3G%AAiTu@H@@dyb1Ew
z&wYt*n8LXS(7%}qzBVBl%1K>6A!CLA|Cs$qeZ<T*W(QL(@>Ri1z@;s8R=rB9=C%LJ
z?T5=Rxt=<~PuJZi^0Yy}z)o}gA5ze82zA3EqOv}KqI@ip-fC&nurNEZt96LdOk)Ia
z`x$tIdx{1BsZpv}Ii)2o47wc*{5O4$T@(}vPzIgvTHr78Si)`pTNx|^D1%Hf0A-Mg
z1fUG=g4L=>n}xk=7*cC%Env+3FYfaHxc#Q^eYW#N7rXPD)M#GC8VzGF$Gt`omVj<I
z3R@~)gwDrBqIU@XVdJghfNIJJ=-JSnsv4C`Hfq7H>ngQZU$4UcmD*qRb;KW_tJ42j
zm!~j0_AGN%e1Kk<M?W@(@(|ZY=lB#Pz^jblvVt|g)vN5PY6c$$xc<nHS2lrp91TLy
z0Iol8`=2x18QxIAV!#9u;X9>tyqER3MZJ{op}t$D$Ci$vK)|S?NSaErBl8cE?)zk$
zJIzcna+0bw?|+m-Lql^^@rdXtdx;t*y!BZ+TTUZf8fZl!4&MKG|B4*<kXmq;u4IJV
znSEn_Ur5ZYQn?K&e;tP&Y*`+j=zB=FU$WWyn&ZCgcnCJDO8|ZccE_0nW@pN;B}Nk(
zxp~R<@QIfv*3P~IIs3(xFtj?BS#{08u5eRCOZlEG`ZQEO$N;0Yh0Fqtqp*P=|1Kh$
zoHHm_j#9N-_fTFzd}6`h^lhkLOC?UX9k?En_KJNsU}dk^54olW7%QwqOXhb1ialm-
zATohT0FFqT17RK=U@~;dTfAYGp`gTN=Q)+$RXJn6Y4WOttMqtQQwg%_>AxYcdsVHp
z*1@xWxMS@FDxXQ#L0tuDw}2nDr18&MP&hmkR~~x0-763d(FK4Rso0K$wvvo1;->m!
zl1_z{3IL=tm;XDR`S*p=8j#LR7#k(Cig2nfQJ0MCioFZ3<*c@rga+u5Le~@GkHj#H
z&}Smb-a<D9J@scO67KDkFTDQ$0Y3**f+)5B%mh{2mI1)e`M(!%CLfnCVg#c@q^zp`
zoLk0<>sMDGUP7M;q4euYCa~A5by#0^x89|lES1tI7t3%9tJGDG_jrk0P2oZYHrJH!
zYMjnRGN{<BL{$GNc5bWSuY}x7mebiDQv2jW);bVz7g8v+Jrc=B@mg_eQ3qHR*@n7a
zuVlYCdy2%)M2ZOiM~M6&k92Fc(EP`skibCgB9)9NI`#35b^{^~<CYIpX{BvB!di0q
zN~r`cgCSIL6v<e4Lau|E2xulzI?+$d(v{UM;iXdVF!pWsHDz-hm0Iq`J3VXBkgdn6
z!1(s_nr*>rtv>pvdM%LGrbR|k*=aY*A2S(2IyzBLhcD?`!7f){h8-0`gTO`1rReOa
z=#ujS`eLK^x;T?+&G9>q2s!~s!lFn-r=0X4?l(urJco9N2SnYgiz%=dlWx$}mBVXg
zk+T1%kqD4im^DV5bu#Jv*l1>;drp!1xw&0~tSu4}k1hyM=T(<SxsDiaaJ5D%U|nKo
zHidtSjiXa+Mq}m0dRuGP#n$^41^+8^C!2%T;2{i?rveePa|rwAU*gR6{I(lZYZSgv
zWYSucM-N%g`N50Wp`M~(uE$1LM?37{O^}h=s37AqzZYx-A3+eUipdVK)y+(KQ5KwI
z0)_rg<M4AiW<pezK$uj5Tuj)r#rDNrFYLClLTQ6@whz6uX6yQ-o~h%CL+zT+{2!^s
zm8vk-;zgNTI&sb9{n6hJql3v&C~G6=-8IH|cPWbxIz`h?MhV-;Kg_isYbQ|65*azo
z46{r){}Qdv`nR!T6`(tP4{i$OPY6bk!ks6hR7<a9RYnggI;x;nbVZoHC5hJ#oG|sa
zH@2>9x4}?f*fEAsFkP8aDOf_HtgL~G1m`1$A4=faM9#JFZHNO^M}#26hxB>wqfSjX
zonr)6=n8{~cyww{YS$TsSS1<^js*8R1eb5<OQrv&cqaBsERWkiTFQrDpi>6EFrHV6
zVZ*Sc+gWTO@fXU$;wYc}*+VOSq_z}hGjmz5IL{c<FXiF>k^$DtiG-^rC<MwzPH|3E
zY39TIB0EuP>+7DfWp!xGK8>(xv}B~}Dy4|hsdbJmHogDzQW3vxSyx!9#6Wj+mz~<i
zpex~!tvYy8MwCPWT5!LU`;HfCM+I*q;{ohrO$BKbexz@$#<f-Ca{Q;hetj$v2r@et
zgR-Ud@cW%*517k{fSj$N8?QrD2f~PFs(%B=sZA$yDqjgu2+tV?Xpj}w)0!5{<o1~$
zz5I%={1}up7)?J$iwK}XViByXJHVq|N^K!N)wiDEGRJm7_>eiX+v8fJUj81*2}~b9
z&0|>fWVndwaP@42;~t-3Hs^@euai&;QIu<(5zlTi$JXs)^w>4lJnN}gFJT|#X{<1r
z>uY>Ww%v*vo)ZCL%Mi8)AxN`m4rk1(JC8_DVRU{FF2sjVv4B;i;lIYW5Tho~7vvIJ
z&t8}Z=cpcK)d17Kb~BtfG|pa``Y^qH9b@f?ZRuUO9>rq`N*E<Bh8x<e^Y$O9E_HE-
zN~!n*ox(46VE#>DD`7?g{}VIbKQH}ovTBKb9!QenI*Y<ZBk(0wr;AO69+0vE>NhAn
zR!sOv*1Jn^P!rlF4cb(`SSmwdrCCM*Tg)PHv|J6@>;r*-sGx@6H&-S-Sxwb9lEl%5
zV>7PK@)Hn<ZwXbh4v%|<^x;K-M@yC!Sd2Naf8v9T(3;hAoX2BfT<1*1`Q%K?NjuoR
zmscKXT!(YOj{q5Ju!VpSqMWH{odMLcBHDrg4Jn;$ah79W=d8$y)kcjcgUz0_Igp=g
zNjMR_uYWjZ&zMa@UYmJ8%9%?MC}}GXF=&fag*uG~F$FY{mkFQL?>&(2qrcRXUuSNH
zVlp?P_b959MJKwcUDli_#we%jgr)s=T4eQi8Ebplb_shYe6SLze0ELr7ucyga)+PJ
z+*`)Au-`33d1R|r8*k~Ep<MhsllUhTyF1i(RL7Mju1`DD6Ev%PJ{uPKeuD>Z1zck6
zIc3DCH`^W-&BETk=O;cNBc4G{$-zyk-ptCSn@u3S&?R{<$aWM|W6L-ZaAUK$2|nen
zSe!O=ob<c%eD_=qd$>#YJ5itu=@t)+t{hlZzMcsq!HloM?H}Y?;AC<%SMl~Qm(cQk
z>OS>y3!G{YxM?+DoRBIY)R?&b0d=on9_=?v%#IAG&YQ{)-a53k10Zy_j<<oh@;{o;
zMJ<dtZ~@_=!~HW3<(^s#->^)N?M5zB2@~O&VmFbPB|d9Lp>q|XZG&cq=je<<e#8Bq
z3r=+}&74~yqr(PNu&Csy5)f9YQNnhkQG<?KEC?Hxnh=xyH>Y(DSQ9pf`ZC>I$J;Sm
zM4l5ftQh(wlF_tgz^d#`KsHvIf4O=?oE|x!mj4a5d*fZ<2_T#-4qt&P*=mrxgQrn=
zf@8S_&pCky!sUWs=%>J7=(FI<3NT#_s{e&k8UcYjoAXs6bhD~&MRpH7L9WXP#a6`g
zl#N*!Dx-L{E(v}l*9P;C|3j2EQ8|A30TQ4;20W=!j;kP5axrE;2Opx{spB(~MuWHA
zg4>9<5s=sRyJS=fee+?)8$MBefgT%Zo@)iiVK>{?{Whn7Hh^Zb2FrBq+BjUIQOt{L
zS^b1D|K^n<ln@(+S$?ffLzYeJRYNNd*%>@0Fo{SIBTMWP!GI@reM4=g`^bVDc5A82
zY@ESWcUm$*7xF2SVJ7K7<$!_XwAb4~x7YA`z|Y>ci(GF&%>vF(cAOF>p&fJJ-{u_-
zjdC15;=Y;CSf<{)^92eFyP4eE^NBd%%Y3mU$?gg98?F^KJ6!!VGe^&fy_bx!mhzKa
z?dk($X&{^vK&bgX@Hw6$gIDSr`lg@gHSI?C136ICfVbgr2whzx2f3+5UMN-5DL9yr
zy3SJs$3A-Uf%mGd6nbCpgRVr|R-9NQu7aWMdVr(5tf{1?=P1KQ>aT0Q<uS~NyP4qJ
zFLgK>Go{z48Zw1~T>3rdgiQtTb}6and@+CBYK#{TzRT|SZwO?$<=5lBrQPtabyD%V
zLqdA#gmt}Aus(;XX}-G~U%Tz!V`zin%=Rluj4OC6tx0s_4MR|FgYfIDF;X1FspYm)
zIoHKjMN)I)ZjJi?IHry|tBeqhF*|T9LpGG^!U5>B78e`g)=F**^bmsfa%Il?(zMc8
z93&pgb9vb`(fZeNBuDfvY`KOpp;y|I>j48Aw_Q_h2oS$Q^q)GyWnN%Wn?YB1#p}#_
z+<^Oih1koZ7QTb|Q-@db5gVY2gE`SaQtbB~fjUGnl3S}Ta;-K|vF+VJg&150^H1p^
zgElwM|Jpxx%D^&aS}{Luo&05-Q-usNv32{+$PCW>qz`BeAVdn;{{E}ahT}>y?;9+V
zzjg&)6-q_lCk2YTc?wcR=K?Io-U-CRp5X5$K?G;O6S70)KWEkoHefSDANEM}*~YUN
zc321%`km%ftVTI%Fs5PHtEl)FZRIOs^4Mk>W^?bwY#d3DJJjGLqQ}HLjkm=Hp3@^_
zEZkoG295b=EF>|-Kp?c|o|UOrt6W@9crP-~$4jEucC3#I2my486#=velyl2g@$X;)
zf)JWMi;4*rkyW2T-xhGFi5U{7y16{IXQNqJ7D(tm3oM>zlwvNjC7<iO8Vuz9J7*f@
z2SE*CC@|h{gcMt%P=0GNjySJ9#;o~{a9*&`o^>b$AJd}i(ih&=ohx1N%;{T|vw1$D
zTG<<uHh-H{6~^rlonT+7fp4QrUoWWg`<5GO^?9rNc=%{gnSS5I*$Qc}OC@;ltuv9v
zT*DM0TVf_vAB}L0SV?1v)cH%(rl$<rmc^ku+#p@0K@ZfqJKk)5%e84EE-C^$kTgGY
z+FY?K4(r`NnpMU-MTpsnlwt>og;O}+{7lmr8ax|mViF!TJ042a^~8xLHHq2Ati>#c
z`M>QW952{&jlejizNGb9!({OtLrAaAqW$rp8RIE{<<5)xx`+4#^z9kyf5rx<{sp<a
zbbj!O>TPiP=uy2n+d=AWi1__baW>2l(Wi&F@ufiA0A0MQejvuko$Q?TTzp-%E%}Um
zFMcg&9oVk`Ud(#$oIPt?OnglO@<n*gA=cwp^<{|Xpes`AQ=F%tnPWiqS(KkTpN>EJ
zCk_|SDm1rea;^3ZJp=8Nxs6iznvX$_!*EVy8Slv^-Db%auHQU&+Lf=~_AsBPc8gU!
zV6V0mVCksJ!%)$$Q{B=e(nplLv8_8Rg^zP!*!wlZ7;V{>JoAoS4&Yd4G%TLooMyk~
zzKnAiga2s0Kc*u2ad8e%6eo--Ydl~H^x4oWxC@C#uF2Q#il6EY^d?qPMN{olRewq2
zlyv&1l0tfcHFoC^k}KZo2@S!Q&?1+_dq2YO{k@)I!tHi-2*)g}o6ga#`;nFsUV?zW
zM|qGy02-GbsGhh;t;55r@EtFpUzXpZQT$Tm^p5Tg;HdndgH2Qx2%k#7;E=hX%$)rE
z9;xAH^H!HqcJ9g(DH}^X7Vs0T`E>p`J6OP1YC%sJ+4XkV%T?LSBTUWtevf=aH?qOY
zw;|IL>IYaX^;$JuxKzU>DryscX?18yY1FDF^r1_ZL5t}SSQ_RX^#q)|=+dZb?^gxn
zQ}eUe%YSK4S21Y9K=li<8v3}50$(+8NGYf^0QVc7m027GyO!g1(9<`&$`@Kzdf-3H
zZT97F3fWVJ2$nti42e`?cJsr%9%$aQv8}1WMr_F!a)!;IURF12#`vGStyzcAwRACC
zg|2))ww#o{1<xnsf^vsils|H6PTdQijuH+x-rlVj)~+~wHn--S(!tbxy%kQi5Ei`s
zGBAzQA%98s=oCupS4_mOD_t!YkdoM`arGKMpv4~c?J)!in~42u`#u|3pYv%hA%9AP
z&(QR}MV}^CA7+bIKx`Qj9~#D0F?p`?BdY{!1&Ne>;|pn~*?YSer5ZN3=I3;n(K#?V
z8ZT$T`zXvPb@R=zht)U=iTY{;M%(uQ6lps?x3Rp<sZaN$O!BQdF%Je}g8Ji)?6n;N
zNryHB%mgo<Z2(PK#Kp-g<kMvBYkQLM5lViL4O(a0gZbuH$U8Rqn%0_EG3i%+{c4Sg
zenYX;j`}i!t)suvU8+m-?d*738QDS)Pi4L3&YjU|gja<SoP>HjT<^ABk)Y`;`)Ixa
zi{_p`c9U-s-ab{Z56Pt{OfRlMnMWt8fzWaJe85_J6>&a{-%1za0Jrij>?`3Qp`lFB
z?inY^cEl`+Ek0B~Pp`nDj^A!FzR(#kBve)L>mQMVWnJ6RAwp#0xDGyskjnEdL68*u
zN~+$L!F<L0t}sl>(J9|p5{_d!jH4LV`-^Ydg43Sl>c0UxD?V+<$p$l5+An^l#m~J)
zHsQxW35!P;f?;6zmr^Vn8Ov>A2g+bO;R@of%|Ze+WH^6y_Y1Us!C%52*_SOr3eW2I
ze}?5t`?|xKV!E`Krn<d(Geo;PW|oLy9#E1V6?JvEumm*U_hJty!^zJ-5TC4tb>}t7
z7GU<}if0YwA@oEn^hD$B-_mNwv6^;v+H&KA)0G%}ni>=|)z*Q8G}Tm8$0tUzZk56l
zqaWPC=Eo+r;*ok#toW=BqS*xCK9TH)PfT^8{MX#gZYXe7HsWw#RTMg!PT4tgdR-G-
zxM?SOGJ9WnXYJG%2+ByVQ4?cYB}&)6C5$BfeTbSKAY)FTqa6}Qfk$ZEhZYn^*}s?6
zMpX%y&BSceCn`I|{oQ;pL@}d<l%qsuo?qwN1vY+v%LSZC?I&>s9I`RlBEy*M>Lzx$
zmV9HS)svSDQe{tr*7+Gegk4iwy|c&IbqB?)+Ivml?7EgFG?bVM4C<RaSy$U#c&9Vi
z!DbiW1RrY8mMvukg!dr*e$Io^&DN%%%DyHI_amV0ViX<R*-ACv+S&5#X@UN+rb=Tj
zQMdZV1-IOjko|GRY++ffzp7SBuX0y#fUhE6Hv%`@RK8b)wT^?DQ*Fbq#6ql$9bO}-
zEL)#nauGbMnwC9FZQVK3!eb=h@8Qaq)f#BDex~{HOm&WtrLn2{56^|ni_o}0Y3;W3
z&sv;lQQIL)2z;sGqBD@Z5Yee3cFl8q@n|cBbSPs+6q&9)61loP>-yMxvcxwo+}~2U
z*ySP{FI*A$pY+kEg;F&e#nktd2Df-OME>1~BaVpfO|Bf8$^jO1gmIj+t3K%kaUxJ(
zYCR;D*&R+SJ3gc9fC1HwP+MqFZHHJ|GXo<`O9h;JEs+bt&Vx&xdod>x!vLs?WCk4!
zJO$!(rmA*STOwRC^*wtOaO>T;jej%mw7iuet3hlv(NYO)wJ$C>4`64l;?a^7+;SPy
z<dN^Zmi&U{(lipPQ*Eci7Hdg1&cFF|_p}ySvnd!j*c)b6zpCz^6<9ax<^eGof#eU@
z2P)k{q&PWHElh0hUS8@Ua=FqZC?--hU!=ISl6rZD`Z`8~8fqDS=J3LFZ+Rw>%%w<i
zCFXF$HxT?QCI*!-&Oxgo66@yp?mc8XIq~nI(A2ee&=z6O<m}x$io1zlK|ss6gSCGV
ztjPCF5;d%JLFkO3jZuQH$o$7VqkqpiF@1ULQ}|ZMK?MBByT0xwu;9`B8j0KMKpeM5
z+RKtD6lEkgLj$On-PU2=BKDKs38oSa1qA`#f*v)b;dR!R=<9FgAx=p}Ud{v}tFpmN
zS+%_{E8_^6GT*yciUY@QA6CH!yl~=4QIF)|xqDDEpnonI7d%+nGUY8R*)zPGdLrW<
ztma_*FvIZtvz;1VGOqCO$HMjsQE~e8iZbdGbx8(x)t;K^K0aawte-%v<72*>77`C8
zM=#a2T$~l);tz@`E|0(tsPq#6%@zg0sPe}moU<$AOhdA|Qbf#|6f$)rNW<y`Aj58Y
zem)RUM*etQG5TVA(Yr(!LU~_?s#IL*J~(E%B})3mY4z2gmTOhA-|xFW!n#bRCnH~M
zUTrKO3?%(raYA;V^X^rqsGofb4_KZT%X&u>a^F0Hp{Hc;{M;moqG{tGto=t2n_A_w
zcrj6aEkInF`w>8+f2KDP(bO^%Qu8v?kW8Vee+k*vL^i}_xMyj){(Pi46#d$p+l*>n
zBd3+gnXmmo+^JIp61$WTuP0_#sDvi_=bsJvF!^gdWFzqrqeQZ+&%jzyV?9FsJm<Z#
z9Fc|4E^`-?`x_Jqek0mFHHYx1<KLbHnK2P?DKf&{0BnHOS+3RbR)UB*P#*{A6NWz~
z=9gRnQCQ8|q#4>ztZYdtwYch7y%6<peM=O$*@u4<=+phAXdUHP5a<>p?0aGQQ8{#f
zkOL<0plxsO!e^o}St8#qus)X@oY7(C2hH5=Q=wYzgGC<6;dxSmpaq6*e;+8lJw}oL
zHFsHXQ%5yuPIf)oE4zH8H7R{-noo6{!=ol3EF)k)zQKDkOaomECKf}_J<+#2r|KOB
zJIta;yV>w`=y<+5URg|)|8DwzJ74?(SXT6_=FR=06kQ~UJ1-`94fcJ;d+s&%f-%Fn
zgAfWK#Dk75^F*FBeTp-h68;mE(lLe#7sJeZ{a!#p3v=VIJWSYHob|1pBkP$N^jt2D
zz|!?z#nv3#H5S}}?o3e_c)kBHP3P+#;JUxp(=2GWWFMUShoOTvJnznADctyBh_BT<
zJ4)VP_C}k?Mr`)pbe;&Hv!FwJN?NQYV#Thq=TatOi9QGkMwowq6(AmMtUNBLCnXwB
zREg)1()g{#{dV&$I>_^=r@xcP-nAtxLFWalo*LL&(2~XxtIM5jlG^BEohH4(fN5dc
zSB%DW+W(0uv2v&NgoothaJ#bRkZioiyolZ_q9a4W=e46-Q(hjO={-%Y$H?dKYM9aC
zd7@s`DC_@a|E<+f-`)NkFgYoP3>+@E@<S6o;73zw!Ni8UWZ+`TTRTO$(1ZI+jXeFJ
zY%_}~+dY!#i<Uj43{uTN)6{p2gML6w3r1<Vo~f8@ywA7h?lWw(^DykMBnf8HjAYK$
zp|~_`KG_xPK6QV9-kEyj)<D=tDiNaYUTpePA~a`aU*89e+PfedbW$ubEc}m9@}<Qv
z&>m|(C_E_V)NjJg<^f(~|G#YD=Impo>h0tCnV~BC$SfvFQ_|2C{%06t%nRv=Ig9(D
zk{7`w9dZQo&yOw(L6Sa!N?N*Aytc(Yy364sE9pdkQR5W?hN6iM^r^BRK0q>$-fbgZ
z7*?q-)N|%4f@Lj22RB^X3whdX3gfMVc`n;r7K&<)303qs3Pv<hjFfrca=YP-Yk~xt
zTQfUB;ZGWmHwTQJI*dE{teQ6k#$2_=!{?N$q|`{Yo=U^eFD&!D48V#ZrqRu#6O**m
zEVRsIv5}OS)~)^#qvZKQFGa@+N<R|dDK%Cn*!2jCGM}wySoD|`{}wixb5gzt@qs;r
zc!r2W;K}JNYOPgR*bcSf7+|x7wq>$@=TSNSIgHgOH!Vi*s>rwA9aXjdZNXD8AI72?
z3L%}+YZTB}#~w&j?O9baG_GiBqi8SFsB{^9>3G$we#z$U5KxJ+PV8<r+i6RldbfSg
z)J7yXN&J@5os8CvsogY3a*$Gwx|I}nIXgdNSoI+1fyVQ?c>hmzhTcqzyGFAeHqDR@
zPM^@3D<*k$xpSfM-5b?wq4T|#lT^Pf#yDkUsk86$Lz5v}7e$HesN;<k0`gNHYLxr-
zG~tc=zV7XT?qU8j2&U3~ovmz=Gs}>{Eug5A-0{k>TkgD`FS_~bNp5m|-#B4zH$Cr|
zb(>8xlG9M9z=+0jF!u;gae-9+z>U;ulr_3`d)s{80m6?9WVDV1ualmtA-QAJP4i-n
zSe`@L=_}@_Mr2h7l_vyG!R&%2ckSb(4Wn<&jY+5nP?R~o-*e0SMkVw07y0mDI?T?3
zI|JlYdnE45o;UWl{~fG|@7-d#*HQMNjxU`C^NO|EpNXA~<XY%Y86!W(>l-}$woYB7
zHpuYF5C+Mu!L=`}W@_V=EPysJU0_6-F`tnf8Kmnr#7;czs}Z^3)7UC+P8}Zag~RZ>
z>TFDl^z5eXU)xZULD70qiDO*<F9}p4aJ`IHgO>0{IMI>F5`1Pl;Yh_X-LtFhessR>
zd6q+0l{vRkXXpM>v<c4OcX0Vg9y2yvHgVAWUmxq&jG>>dSgZ1T&@yd{<(LmZvuqYy
z2xLJu*u-L$0ofKD7>z}L2_B1qGSiiQx1y!?JF=tCan-^w_D`Q(>@lC|l4?T~(j#T{
zb+|hF8o<^%DpJW!MZrg~boy|faO?hi*=J6&^)>TAy!P6KHGdLV(kDU|v%w9I%~@21
zv`-Ub(khv3fVpX1^=xnFHs^A4X)7ll*BQ8}U<7&Ew8Q5BMNqfY8;p|1CXL>-YB`Hl
zB?K1bQI`|?lp9inimS(7xRqmahX~wNV~0;*F`1L@P7?I{<H-%2aiNPz2uhI|m@QoH
z*j5cbhyfkcaWF)!MS;oR)~0l4EgXT|JRb&Cm!yW!%}O1b|3nR`15DkgIqIlCaX`|2
zQEJ1bexZ#3k&zlW{O5Uf08ggV7R%Vk6`tgB1t%jgI_E^6+nUdX9a46Bx*u+kU>~<0
zZjV-obAcj^#H5)#JVvse9$Pc@aY?@hXNsTEa`%tORdZvbc<}U9d1m$VgDgUnXrAec
z_~9G&eZS^0LcXn&%BCVzDFS&QDbp`PdRWm)zI|4`C9-}+(9BES>k?!*8YlF<u5b*h
zh|R)e)QMZP*R4Rt=q<p+Ju~;2A>l~92+_@jAz|BGMoqKUM7jT^B%Ygn4l*NZ#a2n{
zmo-{VAqT(>V6z*w3pS%QiwKAIJU3`omh!x@OsFTDqG4{LfU)lJSScy=!QpelrF0Rk
z^_o-(WJO<-ZCXhGPjlE6G>}s<mJlk$MGTqND*6}J60Qwz&5^CfDxv7yiUfp_xl$xr
zewp~i^cTGAaq~`TN89mZo3@SisZq4Ug?BNotkI;6VIx35sjFKoh$sn%VS-AEQWb7i
z_M@m|-I(7iNndu!fRIZ?7ek&#da}qIu4&njxW(flX{4ALVXB@ye%?MmM+OrXU@#wG
z*Gh8bI0t`{^L>#A1s_1*GwpP1!m8wR<MKh(^GTLvG3SVl+aAnsjjV-}8@MHLgESwo
z<}kp{8vf*kXf?j_EME%oMa6*$8kFB~=Rz_+*l%K%`p7kVZE71RWwZs-A-q&*MuQp6
z?Id7muzvRVJ=;CsT+GSEVz*T3)-?i}1fBEkW`<;`$%ZmrnsPQ<NLfdQ&rtNKg|?C3
zrQiBTLzbXAe9<D4b>p0wE8*R6<n&+BBC7RuW4FL`v20@VP>qfQ1uf`-Aq*JDs85ul
zo0pSPsflo+)D=f>x}E!_DNVf=;W<*7ZWo9Bg$uqXd=D1)gJMSYAW6e`jm7a2_o)wL
zB4A-aKcT1grU@Z-#@>qO!Ut->ab|Pltf<i?t4SqHGGGk(b?XE(En5temDJ8R8I|%q
z8L`)e>Zzu#Xw2BV)o+9B3;|BLN?{2A1B6(I;5wbIea1(@d1o7q9-1F@ME$%68e%Z)
zU1{SCMVxLVjV6>cv^#XP0?i(MagHu&>ycjc$n0bPTH5l~_~Eu|(@e5EVVJ_u#Ry6%
zBfD@4xT%gt3cgoqHp{d@h0A9A(=i3fwe7ho;R<WxX<7M>W>i_Tu%HypT>);@Z|&Mw
z23Qa(MMqTGHs3NY^vI32&F)G0v@R_}E7!t9tz7s`?)LYY?%Z@m%}ebyuSe@r)F8TH
zSE-~j_Cn}eygG8lfy>xQ8nJjTLd~uQEu%&E51i_7g0f^)bc#@tT@QUSc5;Oz<C1Yl
z`!AJl3({^&`E5gdmTRj_KY`}boL%qh@(-2%^;VL=$q8Is?1mR*BMQXk(u!TarJMy<
z;f_gJ**j`*U188miuwo~nl;^q0oy8LwgUHQGQ!B?B4lj31hh-rI&0Hr;pzwZTojx{
zY*yit9WpY4-nfpoaX^cblMA?&he>9HDMaO(GH-W1h^+Wlh(vK1!bnu_FesKYiY$&a
zrjD$Cd(f@7;X+`u?VDkK!6Zd-gdBcXk&UR*AA(MtI;zZo>jzvTZXCM`_lMHvY0OeB
zc|BVJkM?)NulL7MM0EM3k~2iT`y$I-FBM*krFXuFtR*B?Do4eCYeSdFxh4l>A~d;F
zK3yjM7OJs@ee*>l;V#(;BbEfICiT>-N9IoFa7B%R?h}tj4j6CH=Ffc5sbqQwI^2Vs
z!P#n$tF;NNF$0gQWqZ0k8)M(U#0xkN!DRR<GsPPZjMNXWqT~wF9wNX6|H|LFF;V2F
zzh5#CvwqL|eG+n+UQu@c*7Y!kk@b5dd!3y5a_-<X+QEXwdGCFMn-IfM>R<w8lRJcG
zsv8f<b2?OCShxhtKu=v>g6hO;*}GQBisaJCvOHGJK`z(aF?T*_*O7(~z;?z(u>gzJ
z3AE-QI(5BJKd4?rl(ad74fkVG@G#nH{dSenXI1=hms}ZVm&XLj<{^M$4rS-SoWI>&
z%!Ey{gH$(U27&w!Cp+ncjDW<QKh%!|KQwBC^!>zn5HFxE;wvIc2h}x~@H+zhI!%5c
z3&I=DJm;`@Vd`1`;8VH-C=zV}?G*J@*x=zKm9_G&<@H`f`BizPPz%!aO>&+hF5LnM
zt9MXGw;Yjoql$V44VFtxFyO}xe%mpj-wa;|Y*nLqV4O`DQM=v)tzq{Rd4`8I`y5Rt
zCx{gGE~{QDA5&Y9a)Mvqd_j-gH_lN;HC(`Gtnar->RBT=DKZHlq^~<Df49I)d(J&r
z_}An8w;arC-(qm=a&vy5u_uPdJ*NhpJTwlux)C^m=bo(4V->T(4th7(6>5OHsf*w_
z=i%=xl|MS*Hv!hm>LbrIc334GhR}sM@Syh8)1NDbeJCB@WK~hTj~K$-z-DX=n~=Kq
z0zdb?f6)_bt=Om16E}#kD%E)y)uWKdMF%3N2lAA*LdCn1QY(xL5!OT_AE~5a#Ue>*
z%rom=8NQ7DrT=KVua38_lID$NI;~ir{dDC~I$L##*oc+Uc4EQhZBAQO8YXt3P#yZJ
ziW)W(`5pyJAZ|!88&HS&uneY48;prZHTt?kE2Q|**KsGeO^Qh>Uq8KRYfpnCiEE|_
zI=Y8%q6iuoVsbjYV4teh|N7%R+%Yp3Fb_ejzBdM*=MKbnhEFLlD3y(L#1s!t20R{Q
zo=h9Cl-mz*A<W>KeMG==_pqnGkr3Kdno0C6YKzS9DXaX2jh=1aFmo!O(;Ue1o-`pF
zr;~aSL)+^G74W-P7X`^Yvm`z-Bu3QO8J2#)ILB}yGQ+|@VhMMNGj3F9!Z?=?Q^Wo1
zjQ!lIjWH2*+Qt#q8+4(^;*;D+;fH+Qb99l>tg@<|)%ur`XKIO^15MqpVkUNLEb9T7
zvoHLYLB?{kPS6=QIPfsNmRYK`zauz%35lw_iOq=)BRcxY?u<8+Csz-ywj7Md0N<9V
z$GOOZa!w7(J<6t^+Q+@dJxNIaS?7d+9i~8}dpe#Glln8yz<8?Pj;HRJZz5qohHEej
zaLl0B#W3+I;f_X=1Uh^CJF1_ZtE`ml$@e%XPI<;Ge#ro$Wu(al-s;Ji2$6!10tx;6
zxARc;vD)`l7U{hNPRd%R<|#jEMsiiYsT=bnDL{u%Xdrg<r%wws=WFNvIp~|hEmboA
zd0%{IxI0ZM7#aKVt;QB-7cZ9`zfF-}N<WH$a};M^<~7ouz$;@JvPs`xIE7E&qtDV}
z=^eq|MG^DnLrqFETptKe8=N|Gapk{J`4E)`-AO%&ljSobbq~>`Q?rba`O|0|easNa
z8qA%)gfyMHfkf=%<CEvbbyYH^fG)^FB3=*D#_LG%N`88;^XpX7&M{|;%rWPM{M3Tb
zG04kMWL)JXz8C~47m?{Tw13xnMD6aDZT;~X<>^Nz49N@kjz_l~VZ>oOnecSi78|M5
zR?U}s&6Of-$ClKy6LWskvY_=k{6rxDy4mSPv>)vIwFX{oS@!wVSfHTgQY778c6+IT
z>$y#C$w<0@KrP&}i?$$VDcsXgaw(BoK|V!vX^~q&o-W)|lkDQWA<R>i;v$_)VYWhq
z?^00t(6khTM+XfJzF;1Fz2Ak%(O%@`7jL_zabu-)n2+@f{G1R1(F^WiYL%-c8^kQm
zDoJ%JkD=^FtHcJqmOm1<V#6qNFnlNcQ`kAWhdQd0Dn$t<dN)XnuW}M<+EJ3)7#YRt
zei@=@w_!{UTK6U&Krg;&M+Bcu5$|_n9ZvTfU>7G2{FuA<Zg<YQ+oY9vbamik{%+!B
zMu>6cha>vKkRlFDFU^#XBX@6WL!X;9$ORvXK9OA*s0&6nf7EC)h+PuspH(j~U~MZT
z_iw%tk7rix3gP7iGL1<~y6FZ58uUXKaPcG+;aa$EjWv;Ce(&&jRgamYBsTm9p>HLD
z@2@we1H&)n6TNSxjWjJyhm1Fe1cG}X@4Wzt%*5PU8@}XwgU+<)ohgn#+{wd~%L!ZZ
z52<-5=N?5JK7H7YK$7)L>+fT3^prQ>4iDR=R>jxg>vF)+tFaH;6gCWISV>q!v2Aa=
zhG(JN++>8>v~(FK2YuY9fmg;Hg?noQhr8d;008qJX<!gEAT%H#ASfWna9s`Xk0Y#d
zcpxArE+8OGz}^4789AC5IGd<gh?tmK*jhMS*xAxsI@#I&--9g0>uSh86K8wSf&e+a
wVgMok&j`RkM1ZRuz|b}Z7PiVJHulzlq5kJ}aESjr1p?TE0Ot^H5Ww;O0klDa%K!iX

literal 0
HcmV?d00001

diff --git a/Solutions/Infoblox/Package/mainTemplate.json b/Solutions/Infoblox/Package/mainTemplate.json
index 8e30123920f..efdba304cc8 100644
--- a/Solutions/Infoblox/Package/mainTemplate.json
+++ b/Solutions/Infoblox/Package/mainTemplate.json
@@ -47,7 +47,7 @@
   },
   "variables": {
     "_solutionName": "Infoblox",
-    "_solutionVersion": "3.0.0",
+    "_solutionVersion": "3.0.1",
     "solutionId": "infoblox.infoblox-app-for-microsoft-sentinel",
     "_solutionId": "[variables('solutionId')]",
     "uiConfigId1": "InfobloxDataConnector",
@@ -316,7 +316,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox data connector with template version 3.0.0",
+        "description": "Infoblox data connector with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion1')]",
@@ -1307,7 +1307,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox data connector with template version 3.0.0",
+        "description": "Infoblox data connector with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion2')]",
@@ -1734,7 +1734,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox data connector with template version 3.0.0",
+        "description": "Infoblox data connector with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion3')]",
@@ -2099,7 +2099,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox data connector with template version 3.0.0",
+        "description": "Infoblox data connector with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion4')]",
@@ -2542,7 +2542,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox data connector with template version 3.0.0",
+        "description": "Infoblox data connector with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('dataConnectorVersion5')]",
@@ -2949,7 +2949,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox_Lookup_Workbook Workbook with template version 3.0.0",
+        "description": "Infoblox_Lookup_Workbook Workbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('workbookVersion1')]",
@@ -3107,7 +3107,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox_Workbook Workbook with template version 3.0.0",
+        "description": "Infoblox_Workbook Workbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('workbookVersion2')]",
@@ -3125,7 +3125,7 @@
               },
               "properties": {
                 "displayName": "[parameters('workbook2-name')]",
-                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"370d206d-18b1-43d4-a170-71a4a12ba9b2\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"SOC Insights Overview\",\"subTarget\":\"6\",\"style\":\"link\"},{\"id\":\"63a011d0-c970-408d-b027-a8579848a6fd\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Config Insights Overview\",\"subTarget\":\"8\",\"style\":\"link\"},{\"id\":\"f8b51e3b-e4b2-4ba4-9a9c-bedea05a1ee7\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Blocked Traffic Overview\",\"subTarget\":\"4\",\"style\":\"link\"},{\"id\":\"d3af8e0b-806c-4f1f-b006-845c842bc2fc\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS Overview\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"dbd0c004-e0b4-446c-91cd-5a5af3f6e16e\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DHCP Overview\",\"subTarget\":\"2\",\"style\":\"link\"},{\"id\":\"41df2b27-5f91-4a8b-adcb-e7997f86d6d6\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Audit Log Overview\",\"subTarget\":\"3\",\"style\":\"link\"},{\"id\":\"4f1a6ec7-3d56-4f50-8045-34adbb8d92d0\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Service Log Overview\",\"subTarget\":\"5\",\"style\":\"link\"},{\"id\":\"ffabdc7f-2cb7-40fc-a883-d82609bba051\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Threat Intelligence Overview\",\"subTarget\":\"7\",\"style\":\"link\"}]},\"name\":\"links - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e1e015ea-e688-48be-ac2b-846fe98be48e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"9f36e52f-3282-4976-9187-7b3f551d91e9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(SourceUserName)\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"4bf79012-0d96-4024-8cb6-0b9c0d9407ef\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where isnotempty(SourceHostName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct SourceHostName\\r\\n| sort by SourceHostName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"8b364f17-07f7-4403-8086-26bf36c92536\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Asset\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName)\\r\\n| where isnotempty(DeviceName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct DeviceName\\r\\n| sort by DeviceName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"66255f50-472e-4295-8d64-6b9fa2e3c887\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SLD\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| extend DestinationDnsDomain = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\", SecondLevelDomain)\\r\\n| where isnotempty(SecondLevelDomain)\\r\\n| distinct SecondLevelDomain\\r\\n| order by SecondLevelDomain \\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f0a80c9f-a800-4958-b51c-4b38bfaf6624\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResponseCode\",\"label\":\"Response Code\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSRCode: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode)\\r\\n| where isnotempty(InfobloxDNSRCode) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct InfobloxDNSRCode\\r\\n| sort by InfobloxDNSRCode asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"aeb144ce-64b1-45ba-85d9-f0a2da9a69d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RecordType\",\"label\":\"Record Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType)\\r\\n| where isnotempty(InfobloxDNSQType) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct InfobloxDNSQType\\r\\n| sort by InfobloxDNSQType asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(DestinationDnsDomain)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DestinationDnsDomain\\r\\n| project-rename ['Destination Dns Domain'] = DestinationDnsDomain\\r\\n| project ['Destination Dns Domain'], Count\\r\\n| sort by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Requested FQDNs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Destination Dns Domain\",\"exportParameterName\":\"DestinationDnsDomain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Most Requested FQDNs\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"0\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Most Requested FQDNs' grid to see 'Top 10 Devices'\"},\"conditionalVisibility\":{\"parameterName\":\"DestinationDnsDomain\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 18\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 20\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"72d2b1bd-300c-4f3e-b4ca-4dcaec96fb3a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TopDevices\",\"type\":1,\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(DeviceName)\\r\\n| summarize Count = count() by DeviceName\\r\\n| top 10 by Count desc\\r\\n| summarize DeviceList = make_list(DeviceName)\\r\\n\\r\\n\",\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"102ee8fc-7658-4bca-82f3-54ed66d2ba9d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TopMAC\",\"type\":1,\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" and DestinationDnsDomain == ('{DestinationDnsDomain}') \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(SourceMACAddress)\\r\\n| summarize Count = count() by SourceMACAddress\\r\\n| top 10 by Count desc\\r\\n| summarize DeviceList = make_list(SourceMACAddress)\\r\\n\\r\\n\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4c59d86e-9130-41a4-ba95-4e7974e4de06\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FirstDevice\",\"type\":1,\"query\":\"print (todynamic('{TopDevices}')[0])\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"0f1d8907-d375-4db8-a5c9-f9d7390d8f7f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SecondDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[1]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"bd2a1987-e9ba-42ac-9856-a8c781ebb332\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThirdDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[2]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"04910ee0-5aa4-4897-82d6-15167ad50e01\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FourthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[3]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"9a023fc0-b8b3-4e1e-9d9c-2c5c511cf32f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FifthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[4]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"5619aab8-f9b6-4218-9315-c6741facf4eb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SixthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[5]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4dd8c03f-0ec4-494c-a237-ff5c9ab73f8f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SeventhDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[6]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1a2455e4-36ec-46c9-bb3f-395ff1186abb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EightDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[7]\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"72b22373-007c-4d10-bbdd-bdac49ea666c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NinethDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[8]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"eb44f209-d53b-488f-8275-05294b57b1c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[9]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"bb6a7aa4-0cf3-49d4-9649-179f6d60af71\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FirstMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[0]\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"571e7afc-50fc-4f35-a7cf-c1d23a00effe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SecondMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[1]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"00dca50c-6034-4a97-b1b0-da773ed535e7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThirdMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[2]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"05752a54-7398-4373-9d67-bc5ce96c32a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FourthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[3]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"42233555-d975-4e88-b62e-2a53e728ae38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FifthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[4]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"3a0eea52-845c-4347-b01b-6f4531de2d5c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SixthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[5]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"29854b31-e4cd-4157-94d4-c0c3fef6f9a2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SeventhMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[6]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"959fdc81-126b-44f9-8a82-753bc8d5bebd\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EightMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[7]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"78b51494-7bb5-4a7d-ab01-67483568319d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NinethMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[8]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b66ac0ed-09b2-49e1-bead-88c1a1145f70\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[9]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Hide\",\"comparison\":\"isNotEqualTo\"},\"name\":\"parameters - 18\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top 10 Devices for Domain : {DestinationDnsDomain}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FirstDevice}')\\r\\n| summarize Count = count() by SourceIP\\r\\n| render piechart with(title=tostring(todynamic('{TopDevices}')[0]))\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FirstDevice} , MAC : {FirstMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FirstDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 18\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SecondDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SecondDevice} , MAC : {SecondMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SecondDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{ThirdDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {ThirdDevice} , MAC : {ThirdMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"ThirdDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FourthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FourthDevice} , MAC : {FourthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FourthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FifthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FifthDevice} , MAC : {FifthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FifthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SixthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SixthDevice} , MAC : {SixthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SixthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SeventhDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SeventhDevice} , MAC : {SeventhMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SeventhDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{EightDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {EightDevice} , MAC : {EightMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"EightDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{NinethDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {NinethDevice} , MAC : {NinethMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"NinethDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{TenthDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {TenthDevice} , MAC : {TenthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"TenthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"DestinationDnsDomain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 19\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(SourceUserName)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD})) \\r\\n| project-rename User = SourceUserName\\r\\n| summarize Count = count() by User\\r\\n| project User, Count\\r\\n| sort by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"DNS Requests Count by Users\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"User\",\"exportParameterName\":\"SourceUserName\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\"}}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Top Users\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'DNS Requests Count by Users' grid to see 'Overall DNS Requests made by User' and 'Top 10 Requested Domains by User'\"},\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 19\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\nInfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string, \\r\\nInfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string, \\r\\nInfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand SourceUserName == ('{SourceUserName}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall DNS Requests made by User : {SourceUserName}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 15\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand SourceUserName == ('{SourceUserName}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DestinationDnsDomain\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Requested Domains by User : {SourceUserName}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"group\":\"DestinationDnsDomain\",\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 8\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"showAnalytics\":true,\"title\":\"Response Types\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Response_Type\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"rowLimit\":10000},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 9\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Types of Response' pie chart to see 'DNS Requests' and 'Top 20 Devices'\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\n InfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string,\\r\\n  InfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string,\\r\\n   InfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand InfobloxDNSRCode == ('{Response_Type}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"{Response_Type} DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 16\",\"styleSettings\":{\"padding\":\"17px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand InfobloxDNSRCode == ('{Response_Type}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DeviceName\\r\\n| top 20 by Count\\r\\n\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 20 Devices for {Response_Type} DNS Request\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":20,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSQType)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize count() by InfobloxDNSQType\\r\\n\\r\\n\",\"size\":3,\"showAnalytics\":true,\"title\":\"Query Types\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 10\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| sort by TimeGenerated asc\\r\\n| make-series Count = count() default = 0 on TimeGenerated from ago(1d) to now() step 1h by InfobloxDNSRCode\",\"size\":0,\"title\":\"Overall Queries Per Hour\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"x\",\"exportParameterName\":\"QPS_Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"showDataPoints\":true,\"xSettings\":{\"label\":\"Time\"}}},\"customWidth\":\"100\",\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"18px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Overall Queries Per Hour' bar chart to see 'Queries Per Minutes'\"},\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 20\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 21\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Gridtimestring = tostring('{QPS_Time}');\\r\\nlet Gridtime = todatetime(substring(Gridtimestring, indexof(Gridtimestring, \\\" \\\"), indexof(Gridtimestring, \\\"GMT\\\") - 1 - indexof(Gridtimestring, \\\" \\\"))) -5h - 30m;\\r\\n\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| where TimeGenerated between (Gridtime - 30m .. Gridtime + 30m)\\r\\n| sort by TimeGenerated asc\\r\\n| make-series Count = count() default = 0 on bin(TimeGenerated, 1m) from (Gridtime - 30m) to (Gridtime + 30m) step 1m by InfobloxDNSRCode\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall Queries Per Minute\",\"timeContext\":{\"durationMs\":86400000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"rowLimit\":10000},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Count\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 13\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Gridtimestring = tostring('{QPS_Time}');\\r\\nlet Gridtime = todatetime(substring(Gridtimestring, indexof(Gridtimestring, \\\" \\\"), indexof(Gridtimestring, \\\"GMT\\\") - 1 - indexof(Gridtimestring, \\\" \\\"))) -5h - 30m;\\r\\n\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSQType)\\r\\nand TimeGenerated between ((Gridtime - 30m) .. (Gridtime + 30m))\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DeviceName\",\"size\":3,\"showAnalytics\":true,\"title\":\"Overall Query by Devices per hour\",\"timeContext\":{\"durationMs\":86400000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 17\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\n InfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string,\\r\\n  InfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string,\\r\\n   InfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxAnCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowGreenBlue\"}},{\"columnMatch\":\"InfobloxNsCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowOrangeBrown\"}},{\"columnMatch\":\"InfobloxArCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"SourceUserName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"representation\":\"brown\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 14\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 15\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Main Group\",\"styleSettings\":{\"margin\":\"5px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This workbook depends on the **Infoblox-Get-IP-Space-Data** logic app which is deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic app first and keep it enabled in order to use this workbook.\",\"style\":\"info\"},\"name\":\"text - 15\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"4abe4038-7e69-4b2c-9ec2-e1f9311e96be\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"379d941d-6191-494d-b518-caf9e0d8ce55\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPServer\",\"label\":\"DHCP Server\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(InfobloxHostID) \\r\\n| distinct InfobloxHostID\\r\\n| sort by InfobloxHostID asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"68911f86-d896-407d-9a0b-07934f997037\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(SourceHostName) and (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| distinct SourceHostName\\r\\n| sort by SourceHostName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"c5628a47-4153-4808-a618-9a06d560428b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MAC\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(SourceMACAddress) and (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| distinct SourceMACAddress\\r\\n| sort by SourceMACAddress asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"053f6da7-3bb9-4f9f-9bc5-ec09a9723f52\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"IP_Space\",\"label\":\"IP Space\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxIPSpace: string, InfobloxHostID: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(name_s)\\r\\n| distinct name_s\\r\\n| order by name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"showAnalytics\":true,\"title\":\"Released DHCP Leases (Unique IPs)\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize count()\",\"size\":3,\"showAnalytics\":true,\"title\":\"Released DHCP Leases\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID in (\\\"DHCP-LEASE-CREATE\\\", \\\"DHCP-LEASE-UPDATE\\\")\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"showAnalytics\":true,\"title\":\"New / Updated DHCP Leases (Unique IPs)\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n    and DeviceEventClassID in (\\\"DHCP-LEASE-CREATE\\\", \\\"DHCP-LEASE-UPDATE\\\")\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize count()\",\"size\":3,\"showAnalytics\":true,\"title\":\"New / Updated DHCP Leases \",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Leases over Time\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| extend InfobloxLeaseOp = trim(@\\\"\\\\s\\\", InfobloxLeaseOp)\\r\\n| where isnotempty(InfobloxLeaseOp)\\r\\n| summarize count() by InfobloxLeaseOp\",\"size\":3,\"showAnalytics\":true,\"title\":\"DHCP Activity Summary\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Lease\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"51px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'DHCP Activity Summary' pie chart to see 'DHCP Lease for Activity'\"},\"conditionalVisibility\":{\"parameterName\":\"Lease\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand isnotempty(SourceMACAddress)\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count = count() by SourceMACAddress\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 MAC Address\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Pie_MAC\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 6\",\"styleSettings\":{\"padding\":\"53px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 MAC Address' pie chart to see 'Source IPs for MAC'\"},\"conditionalVisibility\":{\"parameterName\":\"Pie_MAC\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxRangeStart: string, InfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string,\\r\\nInfobloxDUID: string, InfobloxLifetime: string,InfobloxLeaseUUID: string, InfobloxFingerprintPr: string,\\r\\nInfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), InfobloxLeaseOp = trim(@\\\"\\\\s\\\", InfobloxLeaseOp)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\nand InfobloxLeaseOp == ('{Lease}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space})) and isnotempty(trim(@\\\"\\\\s\\\", InfobloxLeaseOp))\\r\\n| project-rename ['Date Time'] = TimeGenerated, ['DHCP Server'] = InfobloxHostID, ['Host Name'] = SourceHostName, ['MAC Address'] = SourceMACAddress, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['IP Space'] = name_s, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, Subnet = InfobloxSubnet, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint\\r\\n| project ['Date Time'], ['DHCP Server'], ['Host Name'], ['MAC Address'], ['Source IP'], ['Log Severity'], Activity, ['IP Space'], Computer, ['Collector Host Name'], ['Application Protocol'], Subnet, ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Lease for Activity : {Lease}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Lease\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand SourceMACAddress == ('{Pie_MAC}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Source IPs for MAC : {Pie_MAC}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"conditionalVisibility\":{\"parameterName\":\"Pie_MAC\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 14\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), SourceIP = trim(@\\\"\\\\s\\\", SourceIP)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand isnotempty(SourceIP)\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count=count() by SourceIP\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 IP Addresses\",\"showRefreshButton\":true,\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"SourceIP\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 IP Addresses' grid to see 'Host for IP'\"},\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), SourceIP = trim(@\\\"\\\\s\\\", SourceIP)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\nand SourceIP == ('{SourceIP}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count = count() by SourceHostName\",\"size\":3,\"showAnalytics\":true,\"title\":\"Host for IP : {SourceIP}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 6\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\nand DeviceProduct == \\\"Data Connector\\\" \\r\\nand DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string, InfobloxRangeStart: string,\\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string,\\r\\nInfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, ['DHCP Server'] = InfobloxHostID, ['Host Name'] = SourceHostName, ['MAC Address'] = SourceMACAddress, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['IP Space'] = name_s, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, Subnet = InfobloxSubnet, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint\\r\\n| project ['Date Time'], ['DHCP Server'], ['Host Name'], ['MAC Address'], ['Source IP'], ['Log Severity'], Activity, ['IP Space'], Computer, ['Collector Host Name'], ['Application Protocol'], Subnet, ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Lease\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5\",\"padding\":\"5\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 14\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"group - 5\",\"styleSettings\":{\"margin\":\"5px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"82320096-33a6-4d48-b64f-2c90aa564ed4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"00756d7d-b074-42e5-996e-4ffa6487606f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"UserName\",\"label\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(SourceUserName)\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3d2f3549-f5c5-4496-a013-f9b306321c75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(DeviceAction) and (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| distinct DeviceAction\\r\\n| sort by DeviceAction asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string, InfobloxRangeStart: string, InfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string, InfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName})) \\r\\nand (('{Action:escapjson}') == \\\"*\\\" or DeviceAction in~ ({Action}))\\r\\n| project-rename Action = DeviceAction\\r\\n| summarize Count = count() by Action\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Types of Actions\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"bar_Action\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Action\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Action\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Types of Actions' bar chart to see 'Top 10 User for Action' and 'Audit Logs for Action'\"},\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 4\"}],\"exportParameters\":true},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(SourceUserName)\\r\\nand DeviceAction == ('{bar_Action}')\\r\\nand (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| project-rename User = SourceUserName, Action = DeviceAction\\r\\n| summarize Count = count() by User\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 User for Action : {bar_Action}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Pie_user\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"70px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 User for Action : {bar_Action}' pie chart to see 'Top 10 SourceIP for User'\"},\"conditionalVisibility\":{\"parameterName\":\"Pie_user\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\" \\r\\n    and DeviceAction == ('{bar_Action}')\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxHTTPReqBody: string, InfobloxResourceId: string, InfobloxResourceType: string, InfobloxHTTPRespBody: string, \\r\\nid: string, name: string, pool_id: string, service_type: string, InfobloxSubjectGroups: string, InfobloxRangeStart: string, \\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string, \\r\\nInfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, User = SourceUserName, Action = DeviceAction, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['Infoblox Host ID'] = InfobloxHostID, ['Infoblox IP Space'] = InfobloxIPSpace, Subnet = InfobloxSubnet, ['HTTP Req Body'] = InfobloxHTTPReqBody, ['Resource Id'] = InfobloxResourceId, ['Resource Type'] = InfobloxResourceType, ['HTTP Resp Body'] = InfobloxHTTPRespBody, ['pool id'] = pool_id, ['service type'] = service_type, ['Subject Groups'] = InfobloxSubjectGroups, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint, DUID = InfobloxDUID, ['Application Protocol'] = ApplicationProtocol, ['Collector Host Name'] = CollectorHostName\\r\\n| project ['Date Time'], Action, Activity, User, ['Source IP'], ['Log Severity'], Computer, Message, ['Infoblox Host ID'], ['Infoblox IP Space'], Subnet, ['HTTP Req Body'], ['Resource Id'], ['Resource Type'], ['HTTP Resp Body'], id, name, ['pool id'], ['service type'], ['Subject Groups'], ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], DUID, Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint, ['Application Protocol'], ['Collector Host Name']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Audit Logs for Action : {bar_Action}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\" \\r\\n    and DeviceAction == ('{bar_Action}')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where SourceUserName == ('{Pie_user}') and DeviceAction == ('{bar_Action}')\\r\\n| summarize Count = count() by SourceIP\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Source IP for User : {Pie_user}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Pie_user\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"padding\":\"49px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxHTTPReqBody: string, InfobloxResourceId: string, InfobloxResourceType: string, InfobloxHTTPRespBody: string,\\r\\nid: string, name: string, pool_id: string, service_type: string, InfobloxSubjectGroups: string, InfobloxRangeStart: string,\\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string,\\r\\n InfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName})) \\r\\n  and (('{Action:escapjson}') == \\\"*\\\" or DeviceAction in~ ({Action}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, User = SourceUserName, Action = DeviceAction, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['Infoblox Host ID'] = InfobloxHostID, ['Infoblox IP Space'] = InfobloxIPSpace, Subnet = InfobloxSubnet, ['HTTP Req Body'] = InfobloxHTTPReqBody, ['Resource Id'] = InfobloxResourceId, ['Resource Type'] = InfobloxResourceType, ['HTTP Resp Body'] = InfobloxHTTPRespBody, ['pool id'] = pool_id, ['service type'] = service_type, ['Subject Groups'] = InfobloxSubjectGroups, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint, DUID = InfobloxDUID, ['Application Protocol'] = ApplicationProtocol, ['Collector Host Name'] = CollectorHostName\\r\\n| project ['Date Time'], Action, Activity, User, ['Source IP'], ['Log Severity'], Computer, Message, ['Infoblox Host ID'], ['Infoblox IP Space'], Subnet, ['HTTP Req Body'], ['Resource Id'], ['Resource Type'], ['HTTP Resp Body'], id, name, ['pool id'], ['service type'], ['Subject Groups'], ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], DUID, Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint, ['Application Protocol'], ['Collector Host Name']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Audit Logs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"daee0513-3b57-4c4d-9052-7a92094a4036\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000},\"label\":\"Time Range\"},{\"id\":\"9f36e52f-3282-4976-9187-7b3f551d91e9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| where isnotempty(SourceUserName) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SourceUserName\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"8b364f17-07f7-4403-8086-26bf36c92536\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Asset\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| extend DeviceName = trim(@\\\"\\\\s\\\", DeviceName)\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend DeviceName = trim(@\\\"\\\\s\\\", DeviceName), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(DeviceName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct DeviceName\\r\\n| sort by DeviceName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"cf61f3a4-fe90-4244-b94b-4aedc1210af9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Location\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxB1Region: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(Location) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct Location\\r\\n| sort by Location asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"e63dae9c-b8cf-4c02-9a7f-de990bfc4d1b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SLD\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where isnotempty(SecondLevelDomain)\\r\\n| distinct SecondLevelDomain\\r\\n| order by SecondLevelDomain\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"aeb144ce-64b1-45ba-85d9-f0a2da9a69d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DNSRecordType\",\"label\":\"DNS Record Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxDNSQType: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(InfobloxDNSQType) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct InfobloxDNSQType\\r\\n| order by InfobloxDNSQType asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f67927b9-00eb-4a45-b9d0-4bde9ac74d86\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyName\",\"label\":\"Policy Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(InfobloxB1PolicyName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct InfobloxB1PolicyName\\r\\n| sort by InfobloxB1PolicyName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n    InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location}))\\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(SourceUserName) \\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by User = SourceUserName\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Compromised Users\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"33\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location}))\\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(DestinationDnsDomain)\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by DestinationDnsDomain\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Blocked Domains\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"49px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxRPZ: string, InfobloxPolicyID: string, InfobloxDomainCat: string, InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string, InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by InfobloxRPZ\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Feeds, Filters\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 8\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(DeviceName) \\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by Asset = DeviceName\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Compromised Assets\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Asset\",\"exportParameterName\":\"DeviceName\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"100\",\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 Malicious Assets' grid to see 'Overall Asset Details'\"},\"conditionalVisibility\":{\"parameterName\":\"DeviceName\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxPolicyID: string, InfobloxDomainCat: string,\\r\\n InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string,\\r\\n  InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand DeviceName == ('{DeviceName}')\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, Asset = DeviceName, ['Policy Action'] = InfobloxB1PolicyAction, ['Threat Level'] = InfobloxThreatLevel, ['Policy Name'] = InfobloxB1PolicyName, Severity = LogSeverity, ['Policy ID'] = InfobloxPolicyID, ['Connection Type'] = InfobloxB1ConnectionType, ['DNS Tags'] = InfobloxB1DNSTags, ['Feed Type'] = InfobloxB1FeedType,['Date Time'] = TimeGenerated, ['Source IP'] = SourceIP, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, ['RPZ Rule'] = InfobloxRPZRule, ['Threat Indicator'] = InfobloxB1ThreatIndicator\\r\\n| project ['Date Time'], User, Asset, ['Source IP'], toint(Severity), Activity, Computer, toint(['Threat Level']), ['Collector Host Name'], ['Application Protocol'], ['RPZ Rule'], ['Policy Name'], ['Policy Action'], ['Policy ID'], Location, ['Connection Type'], ['DNS Tags'], ['Threat Indicator'], ['Feed Type']\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall Asset : {DeviceName} Details \",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Threat Level\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"29\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"DeviceName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxPolicyID: string, InfobloxDomainCat: string,\\r\\n InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string,\\r\\n  InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| order by TimeGenerated\\r\\n| project-rename User = SourceUserName, Asset = DeviceName, ['Policy Action'] = InfobloxB1PolicyAction, ['Threat Level'] = InfobloxThreatLevel, ['Policy Name'] = InfobloxB1PolicyName, Severity = LogSeverity, ['Policy ID'] = InfobloxPolicyID, ['Connection Type'] = InfobloxB1ConnectionType, ['DNS Tags'] = InfobloxB1DNSTags, ['Feed Type'] = InfobloxB1FeedType,['Date Time'] = TimeGenerated, ['Source IP'] = SourceIP, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, ['RPZ Rule'] = InfobloxRPZRule, ['Threat Indicator'] = InfobloxB1ThreatIndicator\\r\\n| project ['Date Time'], User, Asset, ['Source IP'], toint(Severity), Activity, Computer, toint(['Threat Level']), ['Collector Host Name'], ['Application Protocol'], ['RPZ Rule'], ['Policy Name'], ['Policy Action'], ['Policy ID'], Location, ['Connection Type'], ['DNS Tags'], ['Threat Indicator'], ['Feed Type']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Blocked DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Threat Level\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"29\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Blocked\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"green\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 7\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This workbook depends on the **Infoblox-Get-Service-Name** and **Infoblox-Get-Host-Name** logic apps which are deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic apps first and keep enabled in order to use this workbook.\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19baf045-4606-49d8-8cb7-ef3ee9fed69a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"af60a861-3c2f-42a5-9045-295348fa5ac6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ServiceName\",\"label\":\"Service Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(name_s)\\r\\n| distinct name_s\\r\\n| order by name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"796c7544-d2ff-42c6-a5c4-816298e72782\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nlet dummy_table_2 = datatable(TimeGenerated: datetime, ophid_g: string, display_name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxLogName:string) with (pair_delimiter='|', kv_delimiter='=')\\r\\n| extend HostID = tostring(split(split(InfobloxLogName, ';')[0], '/')[0])\\r\\n| parse-kv LogSeverity as (InfobloxLogName:string) with (pair_delimiter=' ', kv_delimiter='=')\\r\\n| extend LogSeverityHostID = tostring(split(InfobloxLogName, '/')[0])\\r\\n| extend HostID = iif(isempty(HostID), LogSeverityHostID, HostID)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table_2, Host_Name_Info_CL | extend ophid_g = replace_string(ophid_g, '-', '') |where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by ophid_g) on $left.HostID == $right.ophid_g\\r\\n| extend HostName = trim(@\\\"\\\\s\\\", display_name_s), name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(HostName) and ('{ServiceName:escapejson}' == \\\"*\\\" or name_s in~ ({ServiceName}))\\r\\n| distinct HostName\\r\\n| order by HostName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nlet dummy_table_2 = datatable(TimeGenerated: datetime, ophid_g: string, display_name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxLogName:string) with (pair_delimiter='|', kv_delimiter='=')\\r\\n| extend InfobloxLogName = split(split(InfobloxLogName, ';')[0], '/')\\r\\n| extend HostID = tostring(InfobloxLogName[0]), Process = tostring(InfobloxLogName[1])\\r\\n| parse-kv LogSeverity as (msg:string, InfobloxLogName:string) with (pair_delimiter=' ', kv_delimiter='=')\\r\\n| extend InfobloxLogName = split(InfobloxLogName, '/')\\r\\n| extend LogSeverityHostID = tostring(InfobloxLogName[0]),\\r\\n         LogSeverityProcess = tostring(InfobloxLogName[1]),\\r\\n         Message = split(iif(isempty(Message), msg , Message), '\\\"')[1]\\r\\n| extend Process = iif(isempty(Process), LogSeverityProcess, Process), HostID = iif(isempty(HostID), LogSeverityHostID, HostID)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table_2, Host_Name_Info_CL | extend ophid_g = replace_string(ophid_g, '-', '') |where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by ophid_g) on $left.HostID == $right.ophid_g\\r\\n| extend ['Service Name'] = trim(@\\\"\\\\s\\\", name_s), ['Host Name'] = trim(@\\\"\\\\s\\\", display_name_s), ['Process Name'] = trim(@\\\"\\\\s\\\",Process)\\r\\n| where ('{ServiceName:escapejson}' == \\\"*\\\" or ['Service Name'] in~ ({ServiceName}))\\r\\nand ('{HostName:escapejson}' == \\\"*\\\" or ['Host Name'] in~ ({HostName}))\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], ['Service Name'], ['Process Name'], ['Host Name'], Message\",\"size\":0,\"showAnalytics\":true,\"title\":\"Service Log Data\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This data connector depends on parsers based on Kusto Functions to work as expected called **InfobloxInsight, InfobloxInsightEvents, InfobloxInsightAssets, InfobloxInsightIndicators, **and **InfobloxInsightComments** which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox SOC Insights Workbook\\r\\n\\r\\n##### Get a closer look at your Infoblox SOC Insights. \\r\\n\\r\\nThis workbook is intended to help visualize your [BloxOne SOC Insights](https://csp.infoblox.com/#/insights-console/insights/open/threats) data as part of the **Infoblox SOC Insight Solution**. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| extend isConfigIssue = iff((ThreatClass has_cs (\\\"CONFIGURATIONISSUE\\\")), \\\"Configuration\\\", \\\"Threats\\\")\\r\\n| summarize count() by isConfigIssue\",\"size\":3,\"title\":\"Insight Types\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"pink\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"name\":\"Insight Types\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, Priority: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| summarize dcount(InfobloxInsightID) by Priority\",\"size\":3,\"title\":\"Priority\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"purple\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"Priority\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string, Status: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| summarize count() by ThreatProperty\",\"size\":3,\"title\":\"Threat Families\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"pink\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"name\":\"Threat Families\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string, Status: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| summarize count() by ThreatType\",\"size\":3,\"title\":\"Threat Classes\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"Threat Classes\"}]},\"name\":\"Overall\"},{\"type\":1,\"content\":{\"json\":\"## Using this Workbook\\r\\nTo make use of this workbook, you must ingest Infoblox SOC Insight data into Sentinel in one or both ways:\\r\\n- Deploy the **Infoblox SOC Insights Data Connector** and forward CEF syslog via the Microsoft forwarding agent.\\r\\n- Deploy the **Infoblox-SOC-Get-Open-Insights-API** playbook.\\r\\n\\r\\nYou can use one or both at the same time, but beware of duplicate data!\\r\\n\\r\\nConfigure the **Analytic Queries** that come with this Microsoft Sentinel Solution. They will add the Insights as Incidents, so you can easily track and run playbooks on them.\\r\\n\\r\\nThen, once you have some Insights, run the **Infoblox-SOC-Get-Insight-Details** playbook to get all the gritty details. If you wish, you can then run **Infoblox-SOC-Import-Indicators-TI** to ingest each Indicator of an Insight into Sentinel as **Threat Intelligence**.\\r\\n\\r\\n## Run playbooks directly from this workbook!\\r\\n\\r\\n#### Set the **Resource Group**, [**Tenant ID**](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) and **Playbook** to run when clicking on the **Run Playbook** in the SOC Insight Incidents table below.\\r\\n\\r\\n**Infoblox-SOC-Get-Insight-Details** pulls all the details about each individual Insight. \\r\\n\\r\\n**Infoblox-SOC-Import-Indicators-TI** pushes each Indicator of the Insight into Sentinel as **Threat Intelligence**. You must run the **Infoblox-SOC-Get-Insight-Details** *before* running **Infoblox-SOC-Import-Indicators-TI**.\\r\\n\\r\\nYou will need to run the playbooks for each Insight/Incident. You can do that manually within this workbook with the **Run Playbook** button in the table below, from the **Incidents** blade, or configure them to run automatically with **Analytics**. \\r\\n\\r\\nAfter running **Infoblox-SOC-Get-Insight-Details** on an Insight, **click on it in the table below** to see the details.\\r\\n\\r\\n**You can rerun playbooks on Insights** that already contain data to get the most recent. \",\"style\":\"upsell\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"0 0 5px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e8613f2c-08c6-49e6-a2c6-e12d185c6bd3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResourceTypes\",\"label\":\"Resource Types\",\"type\":7,\"description\":\"This parameter must be set to Logic app.\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"includeAll\":true,\"showDefault\":false},\"value\":[\"microsoft.logic/workflows\"]},{\"id\":\"4a15b858-69b6-4198-abfd-6af5f187d813\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SentinelResourceGroup\",\"label\":\"Incidents Resource Group\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"Resources\\r\\n| where type in~ ({ResourceTypes})\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"7783c2b4-a6e6-4117-92ec-a9a751f01465\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"isGlobal\":true,\"query\":\"where type =~ \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| where resourceGroup =~ \\\"{SentinelResourceGroup}\\\"\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0a92b010-8b48-4601-872f-83e13561b088\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"63c75027-cc56-4958-9296-e0c986ab11e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PlaybookResourceGroup\",\"label\":\"Playbook Resource Group\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| where type in~ ({ResourceTypes})\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"3c6d99b2-1eb1-4650-a3f0-d48dc03f87cb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenantID\",\"label\":\"Tenant ID\",\"type\":1,\"isRequired\":true,\"value\":\"\"},{\"id\":\"e1ea6f58-cd1b-4807-a7de-7da91b787bd4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PlaybookName\",\"label\":\"Playbook\",\"type\":5,\"description\":\"Set the playbook to run when clicking on the \\\"Run Playbook\\\" in the SOC Insight Incidents table below.\",\"isRequired\":true,\"query\":\"Resources\\r\\n| where type in~({ResourceTypes})\\r\\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\\r\\n| where resourceGroup =~ \\\"{PlaybookResourceGroup}\\\"// or '*' in~({PlaybookResourceGroup})\\r\\n| order by name asc\\r\\n| extend Rank = row_number()\\r\\n| project label = tostring(name)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"Infoblox-SOC-Get-Insight-Details\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 0 - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **SOC Insight Incident** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"15px 0 0 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"103f5c4e-6007-46c3-88ed-74fdb7843acc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"7c4c6733-a2d8-40b1-abf5-7f2d777e814c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SelectPriority\",\"label\":\"Priority\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n    { \\\"value\\\":\\\"N/A\\\"},\\r\\n    { \\\"value\\\":\\\"INFO\\\"},\\r\\n    { \\\"value\\\":\\\"LOW\\\"},\\r\\n    { \\\"value\\\":\\\"MEDIUM\\\"},\\r\\n    { \\\"value\\\":\\\"HIGH\\\"},\\r\\n     { \\\"value\\\":\\\"CRITICAL\\\"}\\r\\n]\",\"defaultValue\":\"value::all\",\"value\":[\"value::all\"]},{\"id\":\"3e3ee805-c983-480e-9c10-49a47be4ddc6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Status\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityIncident\\r\\n| where CreatedTime {TimeRange:value}\\r\\n| distinct Status\\r\\n| sort by Status asc\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1c79577f-a4f2-4b2a-aaa7-fbcc5e27831d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Owner\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityIncident\\r\\n| where CreatedTime {TimeRange:value}\\r\\n| where Status in ({Status})\\r\\n| project Owner=tostring(Owner.userPrincipalName)\\r\\n| sort by Owner asc\\r\\n| extend Owner = iff(isnotempty( Owner), Owner, \\\"Unassigned\\\")\\r\\n| distinct Owner\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 19 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let x =\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| extend IncidentID = IncidentName\\r\\n| extend IncidentNumber = toint(IncidentNumber)\\r\\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \\\"Unassigned\\\" in ({Owner}))\\r\\n| extend RunPlaybook = \\\"Run Playbook\\\"\\r\\n| where Title has_cs \\\"Infoblox - SOC Insight\\\"\\r\\n| extend Labels = tostring(Labels)\\r\\n| extend InfobloxInsightID = extract(\\\"InfobloxInsightID: (.*?)\\\\\\\"\\\", 1, Labels)\\r\\n| join \\r\\n    (InfobloxInsight\\r\\n    | summarize arg_max(TimeGenerated, *) by InfobloxInsightID\\r\\n    ) on InfobloxInsightID\\r\\n//sometimes duplicate TimeGenerated so grab LastSeen next\\r\\n| summarize arg_max(LastSeen, *) by IncidentNumber\\r\\n| project IncidentNumber, Severity, Priority, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID\\r\\n; \\r\\nlet incidents =\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\\r\\n| extend IncidentID = IncidentName\\r\\n| extend IncidentNumber = toint(IncidentNumber)\\r\\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \\\"Unassigned\\\" in ({Owner}))\\r\\n| extend RunPlaybook = \\\"Run Playbook\\\"\\r\\n| where Title has_cs \\\"Infoblox - SOC Insight\\\"\\r\\n| extend Alerts = extract(\\\"\\\\\\\\[(.*?)\\\\\\\\]\\\", 1, tostring(AlertIds))\\r\\n| mv-expand AlertIds to typeof(string)\\r\\n//----------------\\r\\n;\\r\\nlet alerts =\\r\\n    SecurityAlert\\r\\n    | extend AlertEntities = parse_json(Entities)\\r\\n    //| extend InfobloxInsightID = tostring(AlertEntities.ObjectGuid)\\r\\n;\\r\\nincidents | join alerts on $left.AlertIds == $right.SystemAlertId\\r\\n//----------------------\\r\\n| summarize AlertCount=dcount(AlertIds) by IncidentNumber, IncidentID, Status, Title,  Alerts, IncidentUrl, Owner=tostring(Owner.userPrincipalName) , RunPlaybook\\r\\n// -------------\\r\\n| join kind=inner (incidents | join alerts on $left.AlertIds == $right.SystemAlertId) on IncidentNumber\\r\\n| join kind=fullouter x on IncidentNumber\\r\\n| summarize arg_max(TimeGenerated,*) by (IncidentNumber)\\r\\n//| where Priority in ({SelectPriority}) or '{SelectPriority:label}' ==  \\\"All\\\"\\r\\n| where Status in ({Status}) or '{Status:label}' ==  \\\"All\\\"\\r\\n| project IncidentNumber, Severity, Priority, Title, Status, Owner, IncidentUrl, RunPlaybook, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID, IncidentID\\r\\n//| project-away IncidentID\\r\\n| order by toint(IncidentNumber) desc\\r\\n\",\"size\":0,\"title\":\"SOC Insight Incidents\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"InfobloxInsightID\",\"parameterName\":\"InfobloxInsightID\",\"parameterType\":1},{\"fieldName\":\"IncidentID\",\"parameterName\":\"IncidentID\",\"parameterType\":1},{\"fieldName\":\"Title\",\"parameterName\":\"Title\",\"parameterType\":1}],\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Informational\",\"representation\":\"Sev4\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"unknown\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Priority\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"INFO\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"LOW\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"MEDIUM\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"HIGH\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"CRITICAL\",\"representation\":\"purple\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Status\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"New\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Active\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Owner\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open Incident\"}},{\"columnMatch\":\"RunPlaybook\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"ArmAction\",\"linkIsContextBlade\":true,\"armActionContext\":{\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{PlaybookResourceGroup:label}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:label}/providers/Microsoft.SecurityInsights/incidents/{IncidentID}/runPlaybook?api-version=2019-01-01-preview\",\"body\":\"{\\r\\n \\\"LogicAppsResourceId\\\":\\\"/subscriptions/{Subscription:id}/resourceGroups/{PlaybookResourceGroup:label}/providers/Microsoft.Logic/workflows/{PlaybookName:label}\\\",\\r\\n \\\"tenantId\\\":\\\"{TenantID}\\\"\\r\\n}\",\"httpMethod\":\"POST\",\"description\":\"# Actions can potentially modify resources.\\n## Please use caution and include a confirmation message in this description when authoring this command.\"}},\"tooltipFormat\":{\"tooltip\":\"Run {PlaybookName} on this insight.\"}},{\"columnMatch\":\"EventsCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"NotBlockedCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"BlockedCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"InsightDataReady\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Data Not Found\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Ready\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"To see data for this insight, run the  Infoblox-SOC-API-Get-Insight-Details playbook.\"}},{\"columnMatch\":\"isPopulated\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Ready\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Data Not Found\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"To see data about this Insight, run the Infoblox-SOC-API-Get-Insight-Details Playbook.\"}},{\"columnMatch\":\"Alerts\",\"formatter\":5},{\"columnMatch\":\"AlertCount\",\"formatter\":0,\"formatOptions\":{\"aggregation\":\"Sum\"}},{\"columnMatch\":\"Entities\",\"formatter\":1},{\"columnMatch\":\"alertCount\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},{\"columnMatch\":\"count_AlertCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"greenRed\"}}],\"rowLimit\":500,\"filter\":true}},\"name\":\"IncidentDetailsView\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Summary\",\"subTarget\":\"Summary\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Assets\",\"subTarget\":\"Assets\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators\",\"subTarget\":\"Indicators\",\"style\":\"link\"},{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events\",\"subTarget\":\"Events\",\"style\":\"link\"},{\"id\":\"03782b90-e744-4654-95c3-a1056cfe78f9\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Comments\",\"subTarget\":\"Comments\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"},\"name\":\"links - 16\",\"styleSettings\":{\"padding\":\"20px 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"#### Click on **SOC Insight Incident** above to view more information.\",\"style\":\"upsell\"},\"conditionalVisibility\":{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 14\",\"styleSettings\":{\"padding\":\"10px 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## {Title}\"},\"name\":\"text - 8\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"5c15d5ff-4108-4538-930b-201f4f8da870\",\"cellValue\":\"https://csp.infoblox.com/#/insights-console/insight/{InfobloxInsightID}/summary\",\"linkTarget\":\"Url\",\"linkLabel\":\"Redirect To Summary on CSP\",\"preText\":\"\",\"style\":\"link\"}]},\"name\":\"links - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(LastSeen)\\r\\n| extend format_datetime(todatetime(FirstSeen), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend FirstSeen = strcat(tostring(FirstSeen), \\\" UTC\\\")\\r\\n| project FirstSeen\",\"size\":3,\"title\":\"First Seen\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"FirstSeen\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"First Seen\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(LastSeen)\\r\\n| extend format_datetime(todatetime(LastSeen), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend LastSeen = strcat(tostring(LastSeen), \\\" UTC\\\")\\r\\n| project LastSeen\",\"size\":3,\"title\":\"Last Seen \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"LastSeen\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Last Seen\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(SpreadingDate)\\r\\n| extend format_datetime(todatetime(SpreadingDate), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend SpreadingDate = strcat(tostring(SpreadingDate), \\\" UTC\\\")\\r\\n| project SpreadingDate\",\"size\":3,\"title\":\"Spreading Date\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"SpreadingDate\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Spreading Date\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(PersistentDate)\\r\\n| extend format_datetime(todatetime(PersistentDate), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend PersistentDate = strcat(tostring(PersistentDate), \\\" UTC\\\")\\r\\n| project PersistentDate\",\"size\":3,\"title\":\"Persistent Date\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"PersistentDate\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Persistent Date\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(BlockedCount)\\r\\n| project BlockedCount\",\"size\":3,\"title\":\"Blocked Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"BlockedCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Blocked Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(NotBlockedCount)\\r\\n| project NotBlockedCount\",\"size\":3,\"title\":\"Not Blocked Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"NotBlockedCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Not Blocked Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(EventsCount)\\r\\n| project EventsCount\\r\\n\",\"size\":3,\"title\":\"Total Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventsCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"gray\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where SourceIP in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP\\r\\n\",\"size\":0,\"title\":\"Top 20 Compromised Assets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Top Impacted IPs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| summarize count() by ThreatIndicator\\r\\n| top 20 by count_ \\r\\n| project ThreatIndicator);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, ThreatIndicator, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatIndicator\\r\\n\",\"size\":0,\"title\":\"Top 20 Indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Top 20 Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() );\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d\",\"size\":0,\"title\":\"Events\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\"},\"customWidth\":\"33\",\"name\":\"Events\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Summary\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Summary\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Assets\\r\\n---\\r\\nSee your protected assets/devices affected by this insight. **Install the Infoblox Endpoint client for more accurate data.**\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **Asset** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"15px 0 15px 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| join\\r\\n(\\r\\n    InfobloxInsightAssets\\r\\n    | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n) on SourceIP\\r\\n| order by LastSeen, EventCount desc\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['OS Version'] = InfobloxB1SrcOSVersion, Network = InfobloxB1Network, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| project SourceIP, User, ['MAC Address'], ['OS Version'], DeviceName, Network,['DHCP Fingerprint'], Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"SourceIP\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"IndicatorDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purpleBlue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"EventCount\",\"label\":\"Associated Events\"},{\"columnId\":\"IndicatorDistinctCount\",\"label\":\"Associated Indicators\"}]}},\"name\":\"Assets\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {SourceIP}\",\"styleSettings\":{\"margin\":\"0 60px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize count() by ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ThreatIndicator, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| summarize Count = count() by ThreatIndicator\\r\\n| order by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\" Indicators for {SourceIP}\",\"styleSettings\":{\"margin\":\"0 15px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatLevel\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Level Trend for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Threat Level Trend for {SourceIP}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction\",\"size\":0,\"showAnalytics\":true,\"title\":\"Action Trend for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Not Blocked\",\"color\":\"red\"},{\"seriesName\":\"Log\",\"color\":\"blue\"}]}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Action Trend for {SourceIP}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Events = count() default = 0 on Detected from ago(Lookback) to now() step 1d\",\"size\":0,\"title\":\"All Events for {SourceIP}\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"All Events for {SourceIP}\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Assets\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Assets\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Indicators\\r\\n---\\r\\nAn **Indicator** is a domain or IP address that is seen in the resolution chain of a query from a device.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(InfobloxB1PolicyAction)\\r\\n| summarize count_distinct(ThreatIndicator) by InfobloxB1PolicyAction\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Not Blocked\",\"color\":\"red\"},{\"seriesName\":\"Blocked\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| summarize count_distinct(ThreatIndicator) by ThreatLevel\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"query - 8 - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **Indicator** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 7\",\"styleSettings\":{\"padding\":\"15px 0 15px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"InfobloxB1PolicyActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct InfobloxB1PolicyAction\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AssetCount = (InfobloxInsightIndicators\\r\\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\\r\\n| join kind=inner\\r\\n(\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"66b112e0-3187-4faa-9357-d229e98002ca\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by SourceIP, ThreatIndicator\\r\\n) on $left.InfobloxInsightID == $right.InfobloxInsightID\\r\\n| where ThreatIndicator1 has_cs ThreatIndicator\\r\\n| summarize by SourceIP, ThreatIndicator\\r\\n| summarize ['Unique Asset Count'] = count() by ThreatIndicator);\\r\\n\\r\\n\\r\\nInfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| where InfobloxB1PolicyAction in ({InfobloxB1PolicyActionParam}) or '{InfobloxB1PolicyActionParam:label}' ==  \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' ==  \\\"All\\\"\\r\\n| join\\r\\n    (\\r\\n        AssetCount\\r\\n    ) on ThreatIndicator\\r\\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\\r\\n| extend URL = strcat(\\\"https://csp.infoblox.com/#/security_research/search/auto/\\\", ThreatIndicator, \\\"/summary\\\")\\r\\n| extend sort_order = case(\\r\\n    ThreatLevel == \\\"High\\\", 5,\\r\\n    ThreatLevel == \\\"Medium\\\", 4,\\r\\n    ThreatLevel == \\\"Low\\\", 3,\\r\\n    ThreatLevel == \\\"N/A\\\", 2,\\r\\n    1 // default case if ThreatLevel doesn't match any of the above\\r\\n)\\r\\n| order by sort_order, EventCount desc\\r\\n| project-away sort_order\\r\\n| project-rename ['Policy Action'] = InfobloxB1PolicyAction, ['Feed Name'] = InfobloxB1FeedName\\r\\n| project ThreatIndicator, ['Unique Asset Count'], ['Policy Action'], ThreatLevel, ThreatConfidence, ['Feed Name'], ThreatActor, LastSeen, FirstSeen, EventCount, URL\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"ThreatIndicator\",\"exportParameterName\":\"ThreatIndicator\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Blocked\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Blocked\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Investigate in Dossier\"}},{\"columnMatch\":\"SourceIPDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"bluePurple\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"EventCount\",\"label\":\"Associated Events\"},{\"columnId\":\"URL\",\"label\":\"Investigate in Dossier\"}]}},\"name\":\"Indicators\",\"styleSettings\":{\"margin\":\"0 15px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| join\\r\\n(\\r\\n    InfobloxInsightAssets\\r\\n    | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n) on SourceIP\\r\\n| order by LastSeen, EventCount desc\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['Source OSVersion'] = InfobloxB1SrcOSVersion, Network = InfobloxB1Network, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| summarize by SourceIP, User, ['MAC Address'], ['Source OSVersion'], DeviceName, Network, ['DHCP Fingerprint'], Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Assets for {ThreatIndicator}\",\"noDataMessage\":\"Select an Indicator in the above chart to see details.\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"IndicatorDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purpleBlue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Assets for {ThreatIndicator}\",\"styleSettings\":{\"margin\":\"0 20px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 500 by count_ \\r\\n);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where SourceIP in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP\",\"size\":0,\"showAnalytics\":true,\"title\":\"Source IPs for {ThreatIndicator}\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"createOtherGroup\":15}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Source IPs for {ThreatIndicator}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where Detected >= ago(30d)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['Query Type'] = InfobloxDNSQType, ['Policy Name'] = InfobloxB1PolicyName, ['Policy Action'] = InfobloxB1PolicyAction, Network = InfobloxB1Network, FeedName = InfobloxB1FeedName, ['Source OSVersion'] = InfobloxB1SrcOSVersion, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['Date Time'] = TimeGenerated\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ['Query Type'], ThreatClass, User, DeviceName, SourceIP, ThreatProperty, ['Policy Name'], ['Policy Action'], Network, DNSResponse, DNSView, FeedName, ['MAC Address'], ['Source OSVersion'], ['DHCP Fingerprint'], ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {ThreatIndicator}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {ThreatIndicator}\",\"styleSettings\":{\"margin\":\"0 20px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction\",\"size\":0,\"showAnalytics\":true,\"title\":\"Action Trend for {ThreatIndicator}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Allow - No Log\",\"color\":\"red\"},{\"seriesName\":\"Log\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Action Trend for {ThreatIndicator}\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Indicators\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Indicators\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events\\r\\n---\\r\\nDNS security events associated with this insight.\\r\\n\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatLevel)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatLevel\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Level\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"33\",\"name\":\"Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatClass)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatClass\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Classes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatProperty)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatProperty\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Families\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Threat Families\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by SourceUserName\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Users\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(DeviceName)\\r\\n| where Detected >= ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceName\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Names\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Device Names\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(SourceIP)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Source IPs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1Network)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1Network\",\"size\":4,\"title\":\"Sources\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1PolicyName)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1PolicyName\",\"size\":4,\"title\":\"Policies\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Policies\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1PolicyAction)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1PolicyAction\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Actions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Log\",\"color\":\"lightBlue\"},{\"seriesName\":\"Allow - No Log\",\"color\":\"red\"}]}},\"customWidth\":\"33\",\"name\":\"Actions\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DNSResponse)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DNSResponse\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"DNS Responses\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"DNS Responses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DeviceRegion)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceRegion\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Regions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Device Regions\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DeviceCountry)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceCountry\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Countries\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"33\",\"name\":\"Device Countries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| project-rename ['Query Type'] = InfobloxDNSQType, ['Policy Name'] = InfobloxB1PolicyName, ['Policy Action'] = InfobloxB1PolicyAction, Network = InfobloxB1Network, FeedName = InfobloxB1FeedName, ['Source OSVersion'] = InfobloxB1SrcOSVersion, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ['Query Type'], ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, ['Policy Name'], ['Policy Action'], Network, DNSResponse, DNSView, FeedName, SourceMACAddress, ['Source OSVersion'], ['DHCP Fingerprint'], ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Events\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightComments\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct  CommentChanger, Comment, DateChanged, Status\\r\\n| order by DateChanged desc\\r\\n| project-rename ['Date Time'] = DateChanged, User = CommentChanger\\r\\n| project ['Date Time'], Status, User, Comment\",\"size\":0,\"title\":\"Comments\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"name\":\"Comments\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Comments\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Comments\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 17\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This Config Insights depends on the **Infoblox-Config-Insights** and **InfoBlox-Config-Insight-Details** logic apps which are deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic apps first and keep it enabled in order to use this Config Insight Details Dashboard.\\r\\n\",\"style\":\"info\"},\"name\":\"text - 4\"},{\"type\":1,\"content\":{\"json\":\"# Infoblox Config Insights\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Steps to view Config Insights Details using this workbook\\r\\n- This workbook is intended to view the available config insights and view their details.\\r\\n- Select the **Resource Group** and **Subscription ID**.\\r\\n- Select TimeRange.\\r\\n- From the **Config Insights** panel, select any config Insight.\\r\\n- You will be able to see the config details of the selected Insight.\\r\\n- If there is message like **The query returned no results** on config details panel, then click on the **GET CONFIG INSIGHT DETAILS** link to get the Config Insight Details for that Config Insight.\\r\\n- This will execute the **InfoBlox-Config-Insight-Details** logic app in the background.\\r\\n- You can check the status of the playbook to identify the Config Insight Details status.\\r\\n- Click on the refresh button of the lookup panel until you get the Config Insight Details.\\r\\n</br>\\r\\n</br>\\r\\n**Note** : In cases where specific indicators may not have lookup information available in Infoblox, users are advised to refer to the Logic App status for further details.\\r\\n\",\"style\":\"upsell\"},\"name\":\"text - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7783c2b4-a6e6-4117-92ec-a9a751f01465\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SubscriptionId\",\"label\":\"Subscription ID\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| distinct subscriptionId\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"4a15b858-69b6-4198-abfd-6af5f187d813\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SentinelResourceGroup1\",\"label\":\"Resource Group\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| where subscriptionId == ('{SubscriptionId}')\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"f70e5d0e-2eff-4bca-9489-90ab64378887\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":false},\"value\":{\"durationMs\":1209600000},\"label\":\"Time Range\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, policyAnalyticsId_g:string) [];\\r\\nunion isfuzzy = true\\r\\ndummy_table,\\r\\nInfoblox_Config_Insights_CL\\r\\n| summarize arg_max(TimeGenerated, *) by policyAnalyticsId_g\\r\\n| extend ConfigInsightDetails = \\\"GET CONFIG INSIGHT DETAILS\\\"\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'],\\r\\n['Policy Analytics ID'] = policyAnalyticsId_g,\\r\\n['Insight Type'] = column_ifexists(\\\"insightType_s\\\",\\\"\\\"),\\r\\n[\\\"Config Insight Details\\\"] = column_ifexists(\\\"ConfigInsightDetails\\\",\\\"\\\")\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Config Insights\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Policy Analytics ID\",\"exportParameterName\":\"ConfigInsightId\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Config Insight Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"ArmAction\",\"linkIsContextBlade\":true,\"armActionContext\":{\"path\":\"/subscriptions/{SubscriptionId}/resourceGroups/{SentinelResourceGroup1}/providers/Microsoft.Logic/workflows/InfoBlox-Config-Insight-Details/triggers/manual/run?api-version=2016-10-01\",\"body\":\"{\\r\\n  \\\"config_insight_id\\\": \\\"{ConfigInsightId}\\\"\\r\\n}\",\"httpMethod\":\"POST\",\"description\":\"# Actions can potentially modify resources.\\n## Please use caution and include a confirmation message in this description when authoring this command.\"}}}],\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"Policy Analytics ID\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Policy Analytics ID\",\"sortOrder\":1}]},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, analyticInsightId_g:string, feeds_s:string) [];\\r\\nunion isfuzzy = true\\r\\ndummy_table,\\r\\nInfoblox_Config_Insight_Details_CL\\r\\n| where analyticInsightId_g == \\\"{ConfigInsightId}\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by analyticInsightId_g\\r\\n| extend ParsedJson = parse_json(feeds_s)\\r\\n| mv-expand ParsedJson\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], \\r\\n['Insight Type'] = insightType_s,\\r\\n['Rule Type'] = ParsedJson.ruleType, \\r\\n['Rule Name'] = ParsedJson.ruleName, \\r\\n['Feed Name'] = ParsedJson.feedName, \\r\\n['Current Action'] = ParsedJson.currentAction, \\r\\n['Recommended Action'] = ParsedJson.recommendedAction, \\r\\n['Status'] = ParsedJson.status\",\"size\":0,\"showAnalytics\":true,\"title\":\"Config Insights Detail for Config ID: {ConfigInsightId}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000}},\"conditionalVisibility\":{\"parameterName\":\"ConfigInsightId\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 16\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Subscription}\"],\"parameters\":[{\"id\":\"a4b4e975-fa7c-46a3-b669-850aacc88134\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Guide\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n    {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\":true},\\r\\n    {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\"}\\r\\n]\"},{\"id\":\"e6ded9a1-a83c-4762-938d-5bf8ff3d3d38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"e3225ed0-6210-40a1-b2d0-66e42ffa71d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| order by name asc\\r\\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\\r\\n| mvexpand All limit 100\\r\\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"15b2c181-7397-43c1-900a-28e175ae8a6f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContextFromParameter\":\"TimeRange\",\"label\":\"Time Range\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Parameter Selectors\"},{\"type\":1,\"content\":{\"json\":\"<svg viewBox=\\\"0 0 19 19\\\" width=\\\"20\\\" class=\\\"fxt-escapeShadow\\\" role=\\\"presentation\\\" focusable=\\\"false\\\" xmlns:svg=\\\"http://www.w3.org/2000/svg\\\" xmlns:xlink=\\\"http://www.w3.org/1999/xlink\\\" aria-hidden=\\\"true\\\"><g><path fill=\\\"#1b93eb\\\" d=\\\"M16.82 8.886c0 4.81-5.752 8.574-7.006 9.411a.477.477 0 01-.523 0C8.036 17.565 2.18 13.7 2.18 8.886V3.135a.451.451 0 01.42-.419C7.2 2.612 6.154.625 9.5.625s2.3 1.987 6.8 2.091a.479.479 0 01.523.419z\\\"></path><path fill=\\\"url(#0024423711759027356)\\\" d=\\\"M16.192 8.99c0 4.392-5.333 7.947-6.483 8.575a.319.319 0 01-.418 0c-1.15-.732-6.483-4.183-6.483-8.575V3.762a.575.575 0 01.313-.523C7.2 3.135 6.258 1.357 9.4 1.357s2.2 1.882 6.274 1.882a.45.45 0 01.419.418z\\\"></path><path d=\\\"M9.219 5.378a.313.313 0 01.562 0l.875 1.772a.314.314 0 00.236.172l1.957.284a.314.314 0 01.174.535l-1.416 1.38a.312.312 0 00-.09.278l.334 1.949a.313.313 0 01-.455.33l-1.75-.92a.314.314 0 00-.292 0l-1.75.92a.313.313 0 01-.455-.33L7.483 9.8a.312.312 0 00-.09-.278L5.977 8.141a.314.314 0 01.174-.535l1.957-.284a.314.314 0 00.236-.172z\\\" class=\\\"msportalfx-svg-c01\\\"></path></g></svg>&nbsp;<span style=\\\"font-family: Open Sans; font-weight: 620; font-size: 14px;font-style: bold;margin:-10px 0px 0px 0px;position: relative;top:-3px;left:-4px;\\\"> Please take time to answer a quick survey,\\r\\n</span>[<span style=\\\"font-family: Open Sans; font-weight: 620; font-size: 14px;font-style: bold;margin:-10px 0px 0px 0px;position: relative;top:-3px;left:-4px;\\\"> click here. </span>](https://forms.office.com/r/n9beey85aP)\"},\"name\":\"Survey\"},{\"type\":1,\"content\":{\"json\":\"# [Threat Intelligence](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence)\\n---\\n\\nWithin a Security Information and Event Management (SIEM) solution like Microsoft Sentinel, the most commonly used form of CTI is threat indicators, also known as Indicators of Compromise or IoCs. Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it can be applied to security products and automation in large scale to detect potential threats to an organization and protect against them. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions. [Video Demo](https://youtu.be/4Bet2oVODow)\\n\"},\"customWidth\":\"79\",\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Workbook Overview\"},{\"type\":1,\"content\":{\"json\":\"![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) \"},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Microsoft Sentinel Logo\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"18c690d7-7cbd-46c1-b677-1f72692d40cd\",\"cellValue\":\"TAB\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators Ingestion\",\"subTarget\":\"Indicators\",\"preText\":\"Alert rules\",\"style\":\"link\"},{\"id\":\"f88dcf47-af98-4684-9de3-1ee5f48f68fc\",\"cellValue\":\"TAB\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators Search\",\"subTarget\":\"Observed\",\"style\":\"link\"}]},\"name\":\"Tabs link\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\\r\\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \\\"IP\\\",\\r\\n                        iff(isnotempty(Url), \\\"URL\\\",\\r\\n                        iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \\\"Email\\\",\\r\\n                        iff(isnotempty(FileHashValue), \\\"File\\\",\\r\\n                         iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \\\"Domain\\\",\\r\\n                        \\\"Other\\\")))))\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by IndicatorType, bin(TimeGenerated, 1h)\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=stacked \",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Imported into Sentinel by Indicator Type and Date\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by SourceSystem, bin(TimeGenerated, 1h)\\r\\n| render barchart kind=stacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Imported into Sentinel by Indicator Provider and Date\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\\r\\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \\\"IP\\\",\\r\\n                        iff(isnotempty(Url), \\\"URL\\\",\\r\\n                        iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \\\"Email\\\",\\r\\n                        iff(isnotempty(FileHashValue), \\\"File\\\",\\r\\n                         iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \\\"Domain\\\",\\r\\n                        \\\"Other\\\")))))\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by IndicatorType\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=unstacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Indicator Type\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by SourceSystem\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=unstacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Indicator Source\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by tostring(ConfidenceScore)\\r\\n| order by CountOfIndicators desc \\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Confidence Score\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DomainQuery=view() { \\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(DomainName)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by DomainName\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"DomainEntry\\\"\\r\\n};\\r\\nlet UrlQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(Url)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by Url\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"UrlEntry\\\"\\r\\n};\\r\\nlet FileHashQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(FileHashValue)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by FileHashValue\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"FileHashEntry\\\"\\r\\n};\\r\\nlet IPQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(NetworkIP) or isnotempty(NetworkSourceIP)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by NetworkIP, NetworkSourceIP\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"IPEntry\\\"\\r\\n};\\r\\nlet EmailAddressQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(EmailSenderAddress)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSenderAddress\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"EmailAddressEntry\\\"\\r\\n};\\r\\nlet EmailMessageQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(EmailSubject)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSubject\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"EmailMessageEntry\\\"\\r\\n};\\r\\nlet SingleSourceIndicators=view(){\\r\\n    DomainQuery\\r\\n    | union UrlQuery\\r\\n    | union FileHashQuery\\r\\n    | union IPQuery\\r\\n    | union EmailAddressQuery\\r\\n    | union EmailMessageQuery\\r\\n    | where array_length(todynamic(SourceSystemArray))==1\\r\\n    | summarize sum(count_) by SourceSystemArray\\r\\n    | extend counter=1 \\r\\n};\\r\\nlet MultipleSourceIndicators=view(){\\r\\n    DomainQuery\\r\\n    | union UrlQuery\\r\\n    | union FileHashQuery\\r\\n    | union IPQuery\\r\\n    | union EmailAddressQuery\\r\\n    | union EmailMessageQuery\\r\\n    | where array_length(todynamic(SourceSystemArray))!=1\\r\\n    | summarize sum(count_) by SourceSystemArray\\r\\n    | extend counter=1\\r\\n};\\r\\nlet CountOfActiveIndicatorsBySource=view(){\\r\\n    ThreatIntelligenceIndicator\\r\\n\\t| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n    | where ExpirationDateTime > now() and Active == true\\r\\n    | summarize count() by SourceSystem\\r\\n    | project SourceSystem, count_\\r\\n};\\r\\nSingleSourceIndicators\\r\\n| join kind=fullouter MultipleSourceIndicators on counter \\r\\n| where SourceSystemArray contains todynamic(SourceSystemArray)[0] \\r\\n| order by SourceSystemArray\\r\\n| extend solitary_count=sum_count_\\r\\n| summarize shared_count = sum(sum_count_1) by SourceSystemArray, solitary_count\\r\\n| extend total_count = shared_count + solitary_count\\r\\n| extend unique_percentage = round(toreal(solitary_count)/toreal(total_count)*100, 1)\\r\\n| extend IndicatorSource = tostring(todynamic(SourceSystemArray)[0])\\r\\n| join kind=inner CountOfActiveIndicatorsBySource on $left.IndicatorSource == $right.SourceSystem\\r\\n| order by unique_percentage desc\\r\\n| project Source=IndicatorSource, UniquenessPercentage=unique_percentage, ActiveIndicators = count_\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Uniqueness of Threat Intelligence Sources\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Source\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"View\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ActiveIndicators\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 12\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"TAB\",\"comparison\":\"isEqualTo\",\"value\":\"Indicators\"},\"name\":\"Indicators Ingestion\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9aec751b-07bd-43ba-80b9-f711887dce45\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Indicator\",\"label\":\"Search Indicator in Events\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Threat Research Parameters\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"50\",\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Add additional lines for desired data columns\\r\\nunion withsource= Table_Name *\\r\\n| where column_ifexists('CallerIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileOriginUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FQDN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessSHA256', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddresses', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Name', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RecipientEmailAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SenderMailFromAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Url', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SrcIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DstIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkSourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHashValue', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkDestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSourceIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSenderAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DomainName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AADEmail', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Account', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Caller', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CompromisedEntity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DisplayName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Email_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessAccountUpn', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('MailboxOwnerUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Owner', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RequesterUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceIdentity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUser', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Upn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('User_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserId_', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId_s_s', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('userName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserName', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('userPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Computer', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHash', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FilePath', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Process', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CommandLine', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NewProcessName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('ParentProcessName', '') has \\\"{Indicator}\\\"\\r\\n| summarize count() by Table_Name \\r\\n| project-rename ['Data Table']=Table_Name, ['Logs Count']=count_\\r\\n| sort by ['Logs Count'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Observed\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Type\",\"exportParameterName\":\"Type\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Data Table\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Log\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Logs Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Add additional lines for desired data columns\\r\\nunion withsource= Table_Name *\\r\\n| where column_ifexists('CallerIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileOriginUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FQDN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessSHA256', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddresses', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Name', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RecipientEmailAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SenderMailFromAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Url', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SrcIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DstIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkSourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHashValue', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkDestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSourceIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSenderAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DomainName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AADEmail', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Account', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Caller', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CompromisedEntity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DisplayName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Email_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessAccountUpn', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('MailboxOwnerUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Owner', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RequesterUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceIdentity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUser', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Upn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('User_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserId_', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId_s_s', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('userName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserName', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('userPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Computer', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHash', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FilePath', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Process', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CommandLine', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NewProcessName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('ParentProcessName', '') has \\\"{Indicator}\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Type\\r\\n| render areachart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Observed over Time\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Data Table\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Log\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Logs Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let tiObservables = ThreatIntelligenceIndicator\\r\\n    | where TimeGenerated < now()\\r\\n    | project IndicatorId, ThreatType, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem;\\r\\nlet alertEntity = SecurityAlert \\r\\n    | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\\r\\n    | mvexpand(Entities)\\r\\n    | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\\r\\n                      iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \\\".\\\", Entities.DnsDomain),\\r\\n                      iif(isnotempty(Entities.Url), Entities.Url,\\r\\n                      iif(isnotempty(Entities.Value), Entities.Value,\\r\\n                      iif(Entities.Type == \\\"account\\\", strcat(Entities.Name,\\\"@\\\",Entities.UPNSuffix),\\\"\\\")))))\\r\\n    | where isnotempty(entity) \\r\\n    | project entity, SystemAlertId, AlertTime;\\r\\nlet IncidentAlerts = SecurityIncident\\r\\n    | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\\r\\n    | mv-expand AlertIds\\r\\n    | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\\r\\nlet AlertsWithTiObservables = alertEntity\\r\\n    | join kind=inner tiObservables on $left.entity == $right.Indicator;\\r\\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\\r\\n    | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\\r\\nIncidentsWithAlertsWithTiObservables\\r\\n| where Indicator contains '{Indicator}' or Indicator == \\\"*\\\"\\r\\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, ThreatType, Source = SourceSystem, Description\\r\\n| sort by Incidents, Alerts desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Intelligence Alerts\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatType\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Botnet\",\"representation\":\"Command and Control\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"MaliciousUrl\",\"representation\":\"Initial_Access\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Malware\",\"representation\":\"Execution\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Phishing\",\"representation\":\"Exfiltration\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Pre attack\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Source\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Incidents\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Alerts\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}}],\"filter\":true}},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n| where TimeGenerated < now()\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], IndicatorId, ThreatType, Active, Tags, TrafficLightProtocolLevel, EmailSenderAddress, FileHashType, FileHashValue, DomainName, NetworkIP\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Intelligence Indicator\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"TAB\",\"comparison\":\"isEqualTo\",\"value\":\"Observed\"},\"name\":\"Indicators Observed\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 7\"}],\"fromTemplateId\":\"sentinel-Infoblox | Infoblox Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"370d206d-18b1-43d4-a170-71a4a12ba9b2\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"SOC Insights Overview\",\"subTarget\":\"6\",\"style\":\"link\"},{\"id\":\"63a011d0-c970-408d-b027-a8579848a6fd\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Config Insights Overview\",\"subTarget\":\"8\",\"style\":\"link\"},{\"id\":\"f8b51e3b-e4b2-4ba4-9a9c-bedea05a1ee7\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Blocked Traffic Overview\",\"subTarget\":\"4\",\"style\":\"link\"},{\"id\":\"d3af8e0b-806c-4f1f-b006-845c842bc2fc\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS Overview\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"dbd0c004-e0b4-446c-91cd-5a5af3f6e16e\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DHCP Overview\",\"subTarget\":\"2\",\"style\":\"link\"},{\"id\":\"41df2b27-5f91-4a8b-adcb-e7997f86d6d6\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Audit Log Overview\",\"subTarget\":\"3\",\"style\":\"link\"},{\"id\":\"4f1a6ec7-3d56-4f50-8045-34adbb8d92d0\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Service Log Overview\",\"subTarget\":\"5\",\"style\":\"link\"},{\"id\":\"ffabdc7f-2cb7-40fc-a883-d82609bba051\",\"cellValue\":\"Parameter\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Threat Intelligence Overview\",\"subTarget\":\"7\",\"style\":\"link\"}]},\"name\":\"links - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e1e015ea-e688-48be-ac2b-846fe98be48e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"9f36e52f-3282-4976-9187-7b3f551d91e9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(SourceUserName)\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"4bf79012-0d96-4024-8cb6-0b9c0d9407ef\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where isnotempty(SourceHostName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct SourceHostName\\r\\n| sort by SourceHostName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"8b364f17-07f7-4403-8086-26bf36c92536\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Asset\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName)\\r\\n| where isnotempty(DeviceName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct DeviceName\\r\\n| sort by DeviceName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"66255f50-472e-4295-8d64-6b9fa2e3c887\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SLD\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| extend DestinationDnsDomain = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\", SecondLevelDomain)\\r\\n| where isnotempty(SecondLevelDomain)\\r\\n| distinct SecondLevelDomain\\r\\n| order by SecondLevelDomain \\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f0a80c9f-a800-4958-b51c-4b38bfaf6624\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResponseCode\",\"label\":\"Response Code\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSRCode: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode)\\r\\n| where isnotempty(InfobloxDNSRCode) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct InfobloxDNSRCode\\r\\n| sort by InfobloxDNSRCode asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"aeb144ce-64b1-45ba-85d9-f0a2da9a69d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RecordType\",\"label\":\"Record Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType)\\r\\n| where isnotempty(InfobloxDNSQType) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\n| distinct InfobloxDNSQType\\r\\n| sort by InfobloxDNSQType asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(DestinationDnsDomain)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DestinationDnsDomain\\r\\n| project-rename ['Destination Dns Domain'] = DestinationDnsDomain\\r\\n| project ['Destination Dns Domain'], Count\\r\\n| sort by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Requested FQDNs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Destination Dns Domain\",\"exportParameterName\":\"DestinationDnsDomain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Most Requested FQDNs\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"0\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Most Requested FQDNs' grid to see 'Top 10 Devices'\"},\"conditionalVisibility\":{\"parameterName\":\"DestinationDnsDomain\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 18\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 20\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"72d2b1bd-300c-4f3e-b4ca-4dcaec96fb3a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TopDevices\",\"type\":1,\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(DeviceName)\\r\\n| summarize Count = count() by DeviceName\\r\\n| top 10 by Count desc\\r\\n| summarize DeviceList = make_list(DeviceName)\\r\\n\\r\\n\",\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"102ee8fc-7658-4bca-82f3-54ed66d2ba9d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TopMAC\",\"type\":1,\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" and DestinationDnsDomain == ('{DestinationDnsDomain}') \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(SourceMACAddress)\\r\\n| summarize Count = count() by SourceMACAddress\\r\\n| top 10 by Count desc\\r\\n| summarize DeviceList = make_list(SourceMACAddress)\\r\\n\\r\\n\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4c59d86e-9130-41a4-ba95-4e7974e4de06\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FirstDevice\",\"type\":1,\"query\":\"print (todynamic('{TopDevices}')[0])\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"0f1d8907-d375-4db8-a5c9-f9d7390d8f7f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SecondDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[1]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"bd2a1987-e9ba-42ac-9856-a8c781ebb332\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThirdDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[2]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"04910ee0-5aa4-4897-82d6-15167ad50e01\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FourthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[3]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"9a023fc0-b8b3-4e1e-9d9c-2c5c511cf32f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FifthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[4]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"5619aab8-f9b6-4218-9315-c6741facf4eb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SixthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[5]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4dd8c03f-0ec4-494c-a237-ff5c9ab73f8f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SeventhDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[6]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1a2455e4-36ec-46c9-bb3f-395ff1186abb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EightDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[7]\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"72b22373-007c-4d10-bbdd-bdac49ea666c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NinethDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[8]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"eb44f209-d53b-488f-8275-05294b57b1c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenthDevice\",\"type\":1,\"query\":\"print todynamic('{TopDevices}')[9]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"bb6a7aa4-0cf3-49d4-9649-179f6d60af71\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FirstMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[0]\",\"timeContext\":{\"durationMs\":2592000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"571e7afc-50fc-4f35-a7cf-c1d23a00effe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SecondMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[1]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"00dca50c-6034-4a97-b1b0-da773ed535e7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThirdMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[2]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"05752a54-7398-4373-9d67-bc5ce96c32a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FourthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[3]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"42233555-d975-4e88-b62e-2a53e728ae38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FifthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[4]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"3a0eea52-845c-4347-b01b-6f4531de2d5c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SixthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[5]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"29854b31-e4cd-4157-94d4-c0c3fef6f9a2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SeventhMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[6]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"959fdc81-126b-44f9-8a82-753bc8d5bebd\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EightMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[7]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"78b51494-7bb5-4a7d-ab01-67483568319d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NinethMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[8]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b66ac0ed-09b2-49e1-bead-88c1a1145f70\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenthMAC\",\"type\":1,\"query\":\"print todynamic('{TopMAC}')[9]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Hide\",\"comparison\":\"isNotEqualTo\"},\"name\":\"parameters - 18\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top 10 Devices for Domain : {DestinationDnsDomain}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FirstDevice}')\\r\\n| summarize Count = count() by SourceIP\\r\\n| render piechart with(title=tostring(todynamic('{TopDevices}')[0]))\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FirstDevice} , MAC : {FirstMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FirstDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 18\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SecondDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SecondDevice} , MAC : {SecondMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SecondDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{ThirdDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {ThirdDevice} , MAC : {ThirdMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"ThirdDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FourthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FourthDevice} , MAC : {FourthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FourthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{FifthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {FifthDevice} , MAC : {FifthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"FifthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SixthDevice}') \\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SixthDevice} , MAC : {SixthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SixthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{SeventhDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {SeventhDevice} , MAC : {SeventhMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SeventhDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{EightDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {EightDevice} , MAC : {EightMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"EightDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{NinethDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {NinethDevice} , MAC : {NinethMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"NinethDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand DestinationDnsDomain == ('{DestinationDnsDomain}')\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand DeviceName == ('{TenthDevice}') \\r\\n| summarize Count = count() by SourceIP\",\"size\":4,\"showAnalytics\":true,\"title\":\"Device : {TenthDevice} , MAC : {TenthMAC}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"TenthDevice\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 9\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"DestinationDnsDomain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 19\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(SourceUserName)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD})) \\r\\n| project-rename User = SourceUserName\\r\\n| summarize Count = count() by User\\r\\n| project User, Count\\r\\n| sort by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"DNS Requests Count by Users\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"User\",\"exportParameterName\":\"SourceUserName\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\",\"compositeBarSettings\":{\"labelText\":\"\"}}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Top Users\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'DNS Requests Count by Users' grid to see 'Overall DNS Requests made by User' and 'Top 10 Requested Domains by User'\"},\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 19\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\nInfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string, \\r\\nInfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string, \\r\\nInfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand SourceUserName == ('{SourceUserName}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall DNS Requests made by User : {SourceUserName}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 15\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand SourceUserName == ('{SourceUserName}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DestinationDnsDomain\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Requested Domains by User : {SourceUserName}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"group\":\"DestinationDnsDomain\",\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceUserName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 8\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"showAnalytics\":true,\"title\":\"Response Types\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Response_Type\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"rowLimit\":10000},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 9\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Types of Response' pie chart to see 'DNS Requests' and 'Top 20 Devices'\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\n InfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string,\\r\\n  InfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string,\\r\\n   InfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand InfobloxDNSRCode == ('{Response_Type}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"{Response_Type} DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 16\",\"styleSettings\":{\"padding\":\"17px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand InfobloxDNSRCode == ('{Response_Type}')\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DeviceName\\r\\n| top 20 by Count\\r\\n\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 20 Devices for {Response_Type} DNS Request\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":20,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Response_Type\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSQType)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize count() by InfobloxDNSQType\\r\\n\\r\\n\",\"size\":3,\"showAnalytics\":true,\"title\":\"Query Types\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 10\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"68px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| sort by TimeGenerated asc\\r\\n| make-series Count = count() default = 0 on TimeGenerated from ago(1d) to now() step 1h by InfobloxDNSRCode\",\"size\":0,\"title\":\"Overall Queries Per Hour\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"x\",\"exportParameterName\":\"QPS_Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"showDataPoints\":true,\"xSettings\":{\"label\":\"Time\"}}},\"customWidth\":\"100\",\"name\":\"query - 11\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"18px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Overall Queries Per Hour' bar chart to see 'Queries Per Minutes'\"},\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 20\",\"styleSettings\":{\"margin\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 21\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Gridtimestring = tostring('{QPS_Time}');\\r\\nlet Gridtime = todatetime(substring(Gridtimestring, indexof(Gridtimestring, \\\" \\\"), indexof(Gridtimestring, \\\"GMT\\\") - 1 - indexof(Gridtimestring, \\\" \\\"))) -5h - 30m;\\r\\n\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSRCode)\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| where TimeGenerated between (Gridtime - 30m .. Gridtime + 30m)\\r\\n| sort by TimeGenerated asc\\r\\n| make-series Count = count() default = 0 on bin(TimeGenerated, 1m) from (Gridtime - 30m) to (Gridtime + 30m) step 1m by InfobloxDNSRCode\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall Queries Per Minute\",\"timeContext\":{\"durationMs\":86400000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"rowLimit\":10000},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Count\",\"color\":\"blueDark\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 13\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Gridtimestring = tostring('{QPS_Time}');\\r\\nlet Gridtime = todatetime(substring(Gridtimestring, indexof(Gridtimestring, \\\" \\\"), indexof(Gridtimestring, \\\"GMT\\\") - 1 - indexof(Gridtimestring, \\\" \\\"))) -5h - 30m;\\r\\n\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand isnotempty(InfobloxDNSQType)\\r\\nand TimeGenerated between ((Gridtime - 30m) .. (Gridtime + 30m))\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by DeviceName\",\"size\":3,\"showAnalytics\":true,\"title\":\"Overall Query by Devices per hour\",\"timeContext\":{\"durationMs\":86400000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"QPS_Time\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 17\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxDNSRCode:string, InfobloxB1Region:string,\\r\\n InfobloxDNSView:string, InfobloxDNSQClass:string, InfobloxDNSQFlags:string, InfobloxAnCount:string, InfobloxNsCount:string,\\r\\n  InfobloxArCount:string, InfobloxB1ConnectionType:string, InfobloxB1OPHName:string, InfobloxB1OPHIPAddress:string, InfobloxB1Network:string,\\r\\n   InfobloxB1SrcOSVersion:string, InfobloxB1DHCPFingerprint:string, InfobloxB1DNSTags:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName), InfobloxDNSRCode = trim(@\\\"\\\\s\\\", InfobloxDNSRCode), InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), DestinationDnsDomain = trim(@\\\"\\\\s\\\", DestinationDnsDomain), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand (('{RecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({RecordType}))\\r\\nand (('{ResponseCode:escapjson}') == \\\"*\\\" or InfobloxDNSRCode in~ ({ResponseCode}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, ['Host Name'] = SourceHostName, ['Query Type'] = InfobloxDNSQType, ['Response Type'] = InfobloxDNSRCode, Location = InfobloxB1Region, ['DNS View'] = InfobloxDNSView, ['DNS Query Class'] = InfobloxDNSQClass, ['DNS Query Flags'] = InfobloxDNSQFlags, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['DNS Response Record Count'] = InfobloxAnCount, ['DNS Response Authoritative Count'] = InfobloxNsCount, ['DNS Response Additional Record Count'] = InfobloxArCount, ['Connection Type'] = InfobloxB1ConnectionType, ['Infoblox HostName'] = InfobloxB1OPHName, ['Infoblox HostIP'] = InfobloxB1OPHIPAddress, Network = InfobloxB1Network, ['Source OS Version'] = InfobloxB1SrcOSVersion, ['DNS Tags'] = InfobloxB1DNSTags, ['Date Time'] = TimeGenerated, ['Device Name'] = DeviceName, ['Device Address'] = DeviceAddress, ['Source IP'] = SourceIP, ['Source Port'] = SourcePort, ['Destination Dns Domain'] = DestinationDnsDomain, ['Additional Extensions'] = AdditionalExtensions, ['Device Event Class ID'] = DeviceEventClassID, ['Application Protocol'] = ApplicationProtocol, ['Log Severity'] = LogSeverity\\r\\n| project ['Date Time'], User,  ['Host Name'], ['Device Name'], ['Device Address'], ['Source IP'], ['Source Port'], Activity, toint(['Log Severity']), ['Destination Dns Domain'], ['Query Type'], ['Response Type'], Location, ['DHCP Fingerprint'], ['DNS View'], ['DNS Query Class'], ['DNS Query Flags'], ['DNS Response Record Count'], ['DNS Response Authoritative Count'], ['DNS Response Additional Record Count'], ['Connection Type'], ['Infoblox HostName'], ['Infoblox HostIP'], Network, ['Source OS Version'], ['DNS Tags'], ['Additional Extensions'], Protocol, ['Device Event Class ID'], ['Application Protocol']\",\"size\":0,\"showAnalytics\":true,\"title\":\"DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Log Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxAnCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowGreenBlue\"}},{\"columnMatch\":\"InfobloxNsCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowOrangeBrown\"}},{\"columnMatch\":\"InfobloxArCount\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"SourceUserName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"representation\":\"brown\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 14\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 15\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Main Group\",\"styleSettings\":{\"margin\":\"5px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This workbook depends on the **Infoblox-Get-IP-Space-Data** logic app which is deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic app first and keep it enabled in order to use this workbook.\",\"style\":\"info\"},\"name\":\"text - 15\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"4abe4038-7e69-4b2c-9ec2-e1f9311e96be\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"379d941d-6191-494d-b518-caf9e0d8ce55\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPServer\",\"label\":\"DHCP Server\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(InfobloxHostID) \\r\\n| distinct InfobloxHostID\\r\\n| sort by InfobloxHostID asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"68911f86-d896-407d-9a0b-07934f997037\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(SourceHostName) and (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| distinct SourceHostName\\r\\n| sort by SourceHostName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"c5628a47-4153-4808-a618-9a06d560428b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MAC\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" and DeviceProduct == \\\"Data Connector\\\" and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where isnotempty(SourceMACAddress) and (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| distinct SourceMACAddress\\r\\n| sort by SourceMACAddress asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"053f6da7-3bb9-4f9f-9bc5-ec09a9723f52\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"IP_Space\",\"label\":\"IP Space\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxIPSpace: string, InfobloxHostID: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(name_s)\\r\\n| distinct name_s\\r\\n| order by name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"showAnalytics\":true,\"title\":\"Released DHCP Leases (Unique IPs)\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize count()\",\"size\":3,\"showAnalytics\":true,\"title\":\"Released DHCP Leases\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID in (\\\"DHCP-LEASE-CREATE\\\", \\\"DHCP-LEASE-UPDATE\\\")\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"showAnalytics\":true,\"title\":\"New / Updated DHCP Leases (Unique IPs)\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n    and DeviceEventClassID in (\\\"DHCP-LEASE-CREATE\\\", \\\"DHCP-LEASE-UPDATE\\\")\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize count()\",\"size\":3,\"showAnalytics\":true,\"title\":\"New / Updated DHCP Leases \",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Leases over Time\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"query - 7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| extend InfobloxLeaseOp = trim(@\\\"\\\\s\\\", InfobloxLeaseOp)\\r\\n| where isnotempty(InfobloxLeaseOp)\\r\\n| summarize count() by InfobloxLeaseOp\",\"size\":3,\"showAnalytics\":true,\"title\":\"DHCP Activity Summary\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Lease\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"51px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'DHCP Activity Summary' pie chart to see 'DHCP Lease for Activity'\"},\"conditionalVisibility\":{\"parameterName\":\"Lease\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand isnotempty(SourceMACAddress)\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count = count() by SourceMACAddress\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 MAC Address\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Pie_MAC\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"name\":\"query - 6\",\"styleSettings\":{\"padding\":\"53px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 MAC Address' pie chart to see 'Source IPs for MAC'\"},\"conditionalVisibility\":{\"parameterName\":\"Pie_MAC\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxRangeStart: string, InfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string,\\r\\nInfobloxDUID: string, InfobloxLifetime: string,InfobloxLeaseUUID: string, InfobloxFingerprintPr: string,\\r\\nInfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), InfobloxLeaseOp = trim(@\\\"\\\\s\\\", InfobloxLeaseOp)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\nand InfobloxLeaseOp == ('{Lease}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space})) and isnotempty(trim(@\\\"\\\\s\\\", InfobloxLeaseOp))\\r\\n| project-rename ['Date Time'] = TimeGenerated, ['DHCP Server'] = InfobloxHostID, ['Host Name'] = SourceHostName, ['MAC Address'] = SourceMACAddress, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['IP Space'] = name_s, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, Subnet = InfobloxSubnet, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint\\r\\n| project ['Date Time'], ['DHCP Server'], ['Host Name'], ['MAC Address'], ['Source IP'], ['Log Severity'], Activity, ['IP Space'], Computer, ['Collector Host Name'], ['Application Protocol'], Subnet, ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Lease for Activity : {Lease}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"Lease\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxLeaseOp: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand SourceMACAddress == ('{Pie_MAC}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Source IPs for MAC : {Pie_MAC}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"conditionalVisibility\":{\"parameterName\":\"Pie_MAC\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 14\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string) with (kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), SourceIP = trim(@\\\"\\\\s\\\", SourceIP)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\nand isnotempty(SourceIP)\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count=count() by SourceIP\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 IP Addresses\",\"showRefreshButton\":true,\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"SourceIP\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 IP Addresses' grid to see 'Host for IP'\"},\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName),\\r\\nSourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress), SourceIP = trim(@\\\"\\\\s\\\", SourceIP)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName})) \\r\\nand SourceIP == ('{SourceIP}')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| summarize Count = count() by SourceHostName\",\"size\":3,\"showAnalytics\":true,\"title\":\"Host for IP : {SourceIP}\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 6\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\" \\r\\nand DeviceProduct == \\\"Data Connector\\\" \\r\\nand DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string, InfobloxRangeStart: string,\\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string,\\r\\nInfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend InfobloxHostID = trim(@\\\"\\\\s\\\", InfobloxHostID), SourceHostName = trim(@\\\"\\\\s\\\", SourceHostName), SourceMACAddress = trim(@\\\"\\\\s\\\", SourceMACAddress)\\r\\n| where (('{DHCPServer:escapjson}') == \\\"*\\\" or InfobloxHostID in~ ({DHCPServer})) \\r\\nand (('{MAC:escapjson}') == \\\"*\\\" or SourceMACAddress in~ ({MAC})) \\r\\nand (('{HostName:escapjson}') == \\\"*\\\" or SourceHostName in~ ({HostName}))\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, IP_Space_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxIPSpace == $right.id_s \\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where (('{IP_Space:escapjson}') == \\\"*\\\" or name_s in~ ({IP_Space}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, ['DHCP Server'] = InfobloxHostID, ['Host Name'] = SourceHostName, ['MAC Address'] = SourceMACAddress, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['IP Space'] = name_s, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, Subnet = InfobloxSubnet, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint\\r\\n| project ['Date Time'], ['DHCP Server'], ['Host Name'], ['MAC Address'], ['Source IP'], ['Log Severity'], Activity, ['IP Space'], Computer, ['Collector Host Name'], ['Application Protocol'], Subnet, ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint\",\"size\":0,\"showAnalytics\":true,\"title\":\"DHCP Lease\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5\",\"padding\":\"5\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 14\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"group - 5\",\"styleSettings\":{\"margin\":\"5px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"82320096-33a6-4d48-b64f-2c90aa564ed4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"00756d7d-b074-42e5-996e-4ffa6487606f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"UserName\",\"label\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(SourceUserName)\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3d2f3549-f5c5-4496-a013-f9b306321c75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(DeviceAction) and (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| distinct DeviceAction\\r\\n| sort by DeviceAction asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string, InfobloxRangeStart: string, InfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string, InfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName})) \\r\\nand (('{Action:escapjson}') == \\\"*\\\" or DeviceAction in~ ({Action}))\\r\\n| project-rename Action = DeviceAction\\r\\n| summarize Count = count() by Action\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Types of Actions\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"bar_Action\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Action\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Action\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Types of Actions' bar chart to see 'Top 10 User for Action' and 'Audit Logs for Action'\"},\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 4\"}],\"exportParameters\":true},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where isnotempty(SourceUserName)\\r\\nand DeviceAction == ('{bar_Action}')\\r\\nand (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| project-rename User = SourceUserName, Action = DeviceAction\\r\\n| summarize Count = count() by User\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 User for Action : {bar_Action}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"series\",\"exportParameterName\":\"Pie_user\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 4\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"70px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 User for Action : {bar_Action}' pie chart to see 'Top 10 SourceIP for User'\"},\"conditionalVisibility\":{\"parameterName\":\"Pie_user\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\" \\r\\n    and DeviceAction == ('{bar_Action}')\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxHTTPReqBody: string, InfobloxResourceId: string, InfobloxResourceType: string, InfobloxHTTPRespBody: string, \\r\\nid: string, name: string, pool_id: string, service_type: string, InfobloxSubjectGroups: string, InfobloxRangeStart: string, \\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string, \\r\\nInfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, User = SourceUserName, Action = DeviceAction, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['Infoblox Host ID'] = InfobloxHostID, ['Infoblox IP Space'] = InfobloxIPSpace, Subnet = InfobloxSubnet, ['HTTP Req Body'] = InfobloxHTTPReqBody, ['Resource Id'] = InfobloxResourceId, ['Resource Type'] = InfobloxResourceType, ['HTTP Resp Body'] = InfobloxHTTPRespBody, ['pool id'] = pool_id, ['service type'] = service_type, ['Subject Groups'] = InfobloxSubjectGroups, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint, DUID = InfobloxDUID, ['Application Protocol'] = ApplicationProtocol, ['Collector Host Name'] = CollectorHostName\\r\\n| project ['Date Time'], Action, Activity, User, ['Source IP'], ['Log Severity'], Computer, Message, ['Infoblox Host ID'], ['Infoblox IP Space'], Subnet, ['HTTP Req Body'], ['Resource Id'], ['Resource Type'], ['HTTP Resp Body'], id, name, ['pool id'], ['service type'], ['Subject Groups'], ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], DUID, Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint, ['Application Protocol'], ['Collector Host Name']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Audit Logs for Action : {bar_Action}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"bar_Action\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"50\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\" \\r\\n    and DeviceAction == ('{bar_Action}')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where SourceUserName == ('{Pie_user}') and DeviceAction == ('{bar_Action}')\\r\\n| summarize Count = count() by SourceIP\\r\\n| top 10 by Count desc\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Source IP for User : {Pie_user}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Pie_user\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"padding\":\"49px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"Audit\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxHostID: string, InfobloxIPSpace: string, InfobloxSubnet: string,\\r\\nInfobloxHTTPReqBody: string, InfobloxResourceId: string, InfobloxResourceType: string, InfobloxHTTPRespBody: string,\\r\\nid: string, name: string, pool_id: string, service_type: string, InfobloxSubjectGroups: string, InfobloxRangeStart: string,\\r\\nInfobloxRangeEnd: string, InfobloxLeaseOp: string, InfobloxClientID: string, InfobloxDUID: string, InfobloxLifetime: string,\\r\\n InfobloxLeaseUUID: string, InfobloxFingerprintPr: string, InfobloxFingerprint: string ) with ( kv_delimiter=\\\"=\\\", pair_delimiter=\\\";\\\")\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceAction = trim(@\\\"\\\\s\\\", DeviceAction)\\r\\n| where (('{UserName:escapjson}') == \\\"*\\\" or SourceUserName in~ ({UserName})) \\r\\n  and (('{Action:escapjson}') == \\\"*\\\" or DeviceAction in~ ({Action}))\\r\\n| project-rename ['Date Time'] = TimeGenerated, User = SourceUserName, Action = DeviceAction, ['Source IP'] = SourceIP, ['Log Severity'] = LogSeverity, ['Infoblox Host ID'] = InfobloxHostID, ['Infoblox IP Space'] = InfobloxIPSpace, Subnet = InfobloxSubnet, ['HTTP Req Body'] = InfobloxHTTPReqBody, ['Resource Id'] = InfobloxResourceId, ['Resource Type'] = InfobloxResourceType, ['HTTP Resp Body'] = InfobloxHTTPRespBody, ['pool id'] = pool_id, ['service type'] = service_type, ['Subject Groups'] = InfobloxSubjectGroups, ['Range Start'] = InfobloxRangeStart, ['Range End'] = InfobloxRangeEnd, ['Lease Op'] = InfobloxLeaseOp, ['Client ID'] = InfobloxClientID, Lifetime = InfobloxLifetime, ['Lease UUID'] = InfobloxLeaseUUID, FingerprintPr = InfobloxFingerprintPr, Fingerprint = InfobloxFingerprint, DUID = InfobloxDUID, ['Application Protocol'] = ApplicationProtocol, ['Collector Host Name'] = CollectorHostName\\r\\n| project ['Date Time'], Action, Activity, User, ['Source IP'], ['Log Severity'], Computer, Message, ['Infoblox Host ID'], ['Infoblox IP Space'], Subnet, ['HTTP Req Body'], ['Resource Id'], ['Resource Type'], ['HTTP Resp Body'], id, name, ['pool id'], ['service type'], ['Subject Groups'], ['Range Start'], ['Range End'], ['Lease Op'], ['Client ID'], DUID, Lifetime, ['Lease UUID'], FingerprintPr, Fingerprint, ['Application Protocol'], ['Collector Host Name']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Audit Logs\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"3\"},\"name\":\"group - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"daee0513-3b57-4c4d-9052-7a92094a4036\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000},\"label\":\"Time Range\"},{\"id\":\"9f36e52f-3282-4976-9187-7b3f551d91e9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| where isnotempty(SourceUserName) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| summarize arg_max(TimeGenerated,*) by SourceUserName\\r\\n| distinct SourceUserName\\r\\n| sort by SourceUserName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"8b364f17-07f7-4403-8086-26bf36c92536\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Asset\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| extend DeviceName = trim(@\\\"\\\\s\\\", DeviceName)\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend DeviceName = trim(@\\\"\\\\s\\\", DeviceName), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(DeviceName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct DeviceName\\r\\n| sort by DeviceName desc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"cf61f3a4-fe90-4244-b94b-4aedc1210af9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Location\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxB1Region: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(Location) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct Location\\r\\n| sort by Location asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"e63dae9c-b8cf-4c02-9a7f-de990bfc4d1b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SLD\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where isnotempty(SecondLevelDomain)\\r\\n| distinct SecondLevelDomain\\r\\n| order by SecondLevelDomain\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"aeb144ce-64b1-45ba-85d9-f0a2da9a69d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DNSRecordType\",\"label\":\"DNS Record Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxDNSQType: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(InfobloxDNSQType) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct InfobloxDNSQType\\r\\n| order by InfobloxDNSQType asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f67927b9-00eb-4a45-b9d0-4bde9ac74d86\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyName\",\"label\":\"Policy Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\" \\r\\n    and DeviceProduct == \\\"Data Connector\\\" \\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName), SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName)\\r\\n| where isnotempty(InfobloxB1PolicyName) and (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) and InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| distinct InfobloxB1PolicyName\\r\\n| sort by InfobloxB1PolicyName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":2419200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n    InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location}))\\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(SourceUserName) \\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by User = SourceUserName\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Compromised Users\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 0 - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"maxWidth\":\"33\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType}))\\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset}))\\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location}))\\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(DestinationDnsDomain)\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by DestinationDnsDomain\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Blocked Domains\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]},\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 2\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"49px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxRPZ: string, InfobloxPolicyID: string, InfobloxDomainCat: string, InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string, InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User}))\\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count = count() by InfobloxRPZ\\r\\n| top 10 by Count\",\"size\":3,\"showAnalytics\":true,\"title\":\"Top 10 Feeds, Filters\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10,\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"query - 8\",\"styleSettings\":{\"padding\":\"52px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string, InfobloxB1PolicyName: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand isnotempty(DeviceName) \\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| summarize Count  = count() by Asset = DeviceName\\r\\n| top 10 by Count\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top 10 Compromised Assets\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Asset\",\"exportParameterName\":\"DeviceName\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"100\",\"name\":\"query - 0\",\"styleSettings\":{\"margin\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"💡 Click on 'Top 10 Malicious Assets' grid to see 'Overall Asset Details'\"},\"conditionalVisibility\":{\"parameterName\":\"DeviceName\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 1\"}],\"exportParameters\":true},\"customWidth\":\"50\",\"name\":\"group - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxPolicyID: string, InfobloxDomainCat: string,\\r\\n InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string,\\r\\n  InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand DeviceName == ('{DeviceName}')\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| project-rename User = SourceUserName, Asset = DeviceName, ['Policy Action'] = InfobloxB1PolicyAction, ['Threat Level'] = InfobloxThreatLevel, ['Policy Name'] = InfobloxB1PolicyName, Severity = LogSeverity, ['Policy ID'] = InfobloxPolicyID, ['Connection Type'] = InfobloxB1ConnectionType, ['DNS Tags'] = InfobloxB1DNSTags, ['Feed Type'] = InfobloxB1FeedType,['Date Time'] = TimeGenerated, ['Source IP'] = SourceIP, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, ['RPZ Rule'] = InfobloxRPZRule, ['Threat Indicator'] = InfobloxB1ThreatIndicator\\r\\n| project ['Date Time'], User, Asset, ['Source IP'], toint(Severity), Activity, Computer, toint(['Threat Level']), ['Collector Host Name'], ['Application Protocol'], ['RPZ Rule'], ['Policy Name'], ['Policy Action'], ['Policy ID'], Location, ['Connection Type'], ['DNS Tags'], ['Threat Indicator'], ['Feed Type']\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Overall Asset : {DeviceName} Details \",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Threat Level\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"29\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"DeviceName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| parse-kv AdditionalExtensions as (InfobloxDNSQType:string, InfobloxB1Region:string, InfobloxB1PolicyAction: string,\\r\\n InfobloxB1PolicyName: string, InfobloxRPZRule: string, InfobloxPolicyID: string, InfobloxDomainCat: string,\\r\\n InfobloxB1ConnectionType: string, InfobloxB1Network: string,InfobloxB1SrcOSVersion: string, InfobloxB1DNSTags:string,\\r\\n  InfobloxB1ThreatIndicator: string, InfobloxB1FeedType: string, InfobloxThreatLevel:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| extend SourceUserName = trim(@\\\"\\\\s\\\", SourceUserName), DeviceName = trim(@\\\"\\\\s\\\", DeviceName),\\r\\n    Location = trim(@\\\"\\\\s\\\", InfobloxB1Region), DestinationDnsDomain = trim(@\\\"\\\\s\\\",DestinationDnsDomain),\\r\\n    InfobloxDNSQType = trim(@\\\"\\\\s\\\", InfobloxDNSQType), InfobloxB1PolicyName = trim(@\\\"\\\\s\\\",InfobloxB1PolicyName)\\r\\n| where (('{User:escapjson}') == \\\"*\\\" or SourceUserName in~ ({User})) \\r\\nand (('{DNSRecordType:escapjson}') == \\\"*\\\" or InfobloxDNSQType in~ ({DNSRecordType})) \\r\\nand (('{Asset:escapjson}') == \\\"*\\\" or DeviceName in~ ({Asset})) \\r\\nand (('{Location:escapjson}') == \\\"*\\\" or InfobloxB1Region in~ ({Location})) \\r\\nand (('{PolicyName:escapjson}') == \\\"*\\\" or InfobloxB1PolicyName in~ ({PolicyName}))\\r\\nand InfobloxB1PolicyAction contains \\\"Block\\\"\\r\\n| extend DestinationDnsDomain_ = trim_end(@'.',DestinationDnsDomain)\\r\\n| extend domains = split(DestinationDnsDomain_,'.')\\r\\n| extend SecondLevelDomain =strcat(domains[-2],'.',domains[-1])\\r\\n| extend SecondLevelDomain = trim(@\\\"\\\\s\\\",SecondLevelDomain)\\r\\n| where (('{SLD:escapjson}') == \\\"*\\\" or SecondLevelDomain in~ ({SLD}))\\r\\n| order by TimeGenerated\\r\\n| project-rename User = SourceUserName, Asset = DeviceName, ['Policy Action'] = InfobloxB1PolicyAction, ['Threat Level'] = InfobloxThreatLevel, ['Policy Name'] = InfobloxB1PolicyName, Severity = LogSeverity, ['Policy ID'] = InfobloxPolicyID, ['Connection Type'] = InfobloxB1ConnectionType, ['DNS Tags'] = InfobloxB1DNSTags, ['Feed Type'] = InfobloxB1FeedType,['Date Time'] = TimeGenerated, ['Source IP'] = SourceIP, ['Collector Host Name'] = CollectorHostName, ['Application Protocol'] = ApplicationProtocol, ['RPZ Rule'] = InfobloxRPZRule, ['Threat Indicator'] = InfobloxB1ThreatIndicator\\r\\n| project ['Date Time'], User, Asset, ['Source IP'], toint(Severity), Activity, Computer, toint(['Threat Level']), ['Collector Host Name'], ['Application Protocol'], ['RPZ Rule'], ['Policy Name'], ['Policy Action'], ['Policy ID'], Location, ['Connection Type'], ['DNS Tags'], ['Threat Indicator'], ['Feed Type']\",\"size\":0,\"showAnalytics\":true,\"title\":\"Blocked DNS Requests\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"<=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Threat Level\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"29\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"orange\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Blocked\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"green\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 7\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"4\"},\"name\":\"group - 4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This workbook depends on the **Infoblox-Get-Service-Name** and **Infoblox-Get-Host-Name** logic apps which are deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic apps first and keep enabled in order to use this workbook.\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19baf045-4606-49d8-8cb7-ef3ee9fed69a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":1209600000}},{\"id\":\"af60a861-3c2f-42a5-9045-295348fa5ac6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ServiceName\",\"label\":\"Service Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| extend name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(name_s)\\r\\n| distinct name_s\\r\\n| order by name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"796c7544-d2ff-42c6-a5c4-816298e72782\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"HostName\",\"label\":\"Host Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nlet dummy_table_2 = datatable(TimeGenerated: datetime, ophid_g: string, display_name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxLogName:string) with (pair_delimiter='|', kv_delimiter='=')\\r\\n| extend HostID = tostring(split(split(InfobloxLogName, ';')[0], '/')[0])\\r\\n| parse-kv LogSeverity as (InfobloxLogName:string) with (pair_delimiter=' ', kv_delimiter='=')\\r\\n| extend LogSeverityHostID = tostring(split(InfobloxLogName, '/')[0])\\r\\n| extend HostID = iif(isempty(HostID), LogSeverityHostID, HostID)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId:string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table_2, Host_Name_Info_CL | extend ophid_g = replace_string(ophid_g, '-', '') |where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by ophid_g) on $left.HostID == $right.ophid_g\\r\\n| extend HostName = trim(@\\\"\\\\s\\\", display_name_s), name_s = trim(@\\\"\\\\s\\\", name_s)\\r\\n| where isnotempty(HostName) and ('{ServiceName:escapejson}' == \\\"*\\\" or name_s in~ ({ServiceName}))\\r\\n| distinct HostName\\r\\n| order by HostName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, id_s: string, name_s: string) [];\\r\\nlet dummy_table_2 = datatable(TimeGenerated: datetime, ophid_g: string, display_name_s: string) [];\\r\\nCommonSecurityLog\\r\\n| where TimeGenerated {TimeRange:value}\\r\\n    and DeviceVendor == \\\"Infoblox\\\"\\r\\n    and DeviceProduct == \\\"Data Connector\\\"\\r\\n    and DeviceEventClassID has_cs \\\"Service\\\"\\r\\n    and isnotempty(AdditionalExtensions)\\r\\n| parse-kv AdditionalExtensions as (InfobloxLogName:string) with (pair_delimiter='|', kv_delimiter='=')\\r\\n| extend InfobloxLogName = split(split(InfobloxLogName, ';')[0], '/')\\r\\n| extend HostID = tostring(InfobloxLogName[0]), Process = tostring(InfobloxLogName[1])\\r\\n| parse-kv LogSeverity as (msg:string, InfobloxLogName:string) with (pair_delimiter=' ', kv_delimiter='=')\\r\\n| extend InfobloxLogName = split(InfobloxLogName, '/')\\r\\n| extend LogSeverityHostID = tostring(InfobloxLogName[0]),\\r\\n         LogSeverityProcess = tostring(InfobloxLogName[1]),\\r\\n         Message = split(iif(isempty(Message), msg , Message), '\\\"')[1]\\r\\n| extend Process = iif(isempty(Process), LogSeverityProcess, Process), HostID = iif(isempty(HostID), LogSeverityHostID, HostID)\\r\\n| parse-kv AdditionalExtensions as (InfobloxServiceId: string) with (pair_delimiter=';', kv_delimiter='=')\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table, Service_Name_Info_CL | where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by id_s) on $left.InfobloxServiceId == $right.id_s\\r\\n| join kind=leftouter(union isfuzzy=true dummy_table_2, Host_Name_Info_CL | extend ophid_g = replace_string(ophid_g, '-', '') |where TimeGenerated >= ago(365d) | summarize arg_max(TimeGenerated, *) by ophid_g) on $left.HostID == $right.ophid_g\\r\\n| extend ['Service Name'] = trim(@\\\"\\\\s\\\", name_s), ['Host Name'] = trim(@\\\"\\\\s\\\", display_name_s), ['Process Name'] = trim(@\\\"\\\\s\\\",Process)\\r\\n| where ('{ServiceName:escapejson}' == \\\"*\\\" or ['Service Name'] in~ ({ServiceName}))\\r\\nand ('{HostName:escapejson}' == \\\"*\\\" or ['Host Name'] in~ ({HostName}))\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], ['Service Name'], ['Process Name'], ['Host Name'], Message\",\"size\":0,\"showAnalytics\":true,\"title\":\"Service Log Data\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"5\"},\"name\":\"group - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This data connector depends on parsers based on Kusto Functions to work as expected called **InfobloxInsight, InfobloxInsightEvents, InfobloxInsightAssets, InfobloxInsightIndicators, **and **InfobloxInsightComments** which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox SOC Insights Workbook\\r\\n\\r\\n##### Get a closer look at your Infoblox SOC Insights. \\r\\n\\r\\nThis workbook is intended to help visualize your [BloxOne SOC Insights](https://csp.infoblox.com/#/insights-console/insights/open/threats) data as part of the **Infoblox SOC Insight Solution**. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| extend isConfigIssue = iff((ThreatClass has_cs (\\\"CONFIGURATIONISSUE\\\")), \\\"Configuration\\\", \\\"Threats\\\")\\r\\n| summarize count() by isConfigIssue\",\"size\":3,\"title\":\"Insight Types\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"pink\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"name\":\"Insight Types\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, Priority: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| summarize dcount(InfobloxInsightID) by Priority\",\"size\":3,\"title\":\"Priority\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"purple\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"Priority\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string, Status: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| summarize count() by ThreatProperty\",\"size\":3,\"title\":\"Threat Families\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"MEDIUM\",\"color\":\"orange\"},{\"seriesName\":\"CRITICAL\",\"color\":\"pink\"},{\"seriesName\":\"INFO\",\"color\":\"blue\"},{\"seriesName\":\"LOW\",\"color\":\"yellow\"},{\"seriesName\":\"HIGH\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"name\":\"Threat Families\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(InfobloxInsightID: string, FirstSeen: datetime, ThreatClass: string, ThreatProperty: string, ThreatType: string, FeedSource: string, Priority: string, Status: string) [];\\r\\nunion isfuzzy=true dummy_table,\\r\\nInfobloxInsight\\r\\n| distinct Status, InfobloxInsightID, FirstSeen, ThreatClass, ThreatProperty, ThreatType, FeedSource, Priority\\r\\n| summarize count() by ThreatType\",\"size\":3,\"title\":\"Threat Classes\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"Threat Classes\"}]},\"name\":\"Overall\"},{\"type\":1,\"content\":{\"json\":\"## Using this Workbook\\r\\nTo make use of this workbook, you must ingest Infoblox SOC Insight data into Sentinel in one or both ways:\\r\\n- Deploy the **Infoblox SOC Insights Data Connector** and forward CEF syslog via the Microsoft forwarding agent.\\r\\n- Deploy the **Infoblox-SOC-Get-Open-Insights-API** playbook.\\r\\n\\r\\nYou can use one or both at the same time, but beware of duplicate data!\\r\\n\\r\\nConfigure the **Analytic Queries** that come with this Microsoft Sentinel Solution. They will add the Insights as Incidents, so you can easily track and run playbooks on them.\\r\\n\\r\\nThen, once you have some Insights, run the **Infoblox-SOC-Get-Insight-Details** playbook to get all the gritty details. If you wish, you can then run **Infoblox-SOC-Import-Indicators-TI** to ingest each Indicator of an Insight into Sentinel as **Threat Intelligence**.\\r\\n\\r\\n## Run playbooks directly from this workbook!\\r\\n\\r\\n#### Set the **Resource Group**, [**Tenant ID**](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) and **Playbook** to run when clicking on the **Run Playbook** in the SOC Insight Incidents table below.\\r\\n\\r\\n**Infoblox-SOC-Get-Insight-Details** pulls all the details about each individual Insight. \\r\\n\\r\\n**Infoblox-SOC-Import-Indicators-TI** pushes each Indicator of the Insight into Sentinel as **Threat Intelligence**. You must run the **Infoblox-SOC-Get-Insight-Details** *before* running **Infoblox-SOC-Import-Indicators-TI**.\\r\\n\\r\\nYou will need to run the playbooks for each Insight/Incident. You can do that manually within this workbook with the **Run Playbook** button in the table below, from the **Incidents** blade, or configure them to run automatically with **Analytics**. \\r\\n\\r\\nAfter running **Infoblox-SOC-Get-Insight-Details** on an Insight, **click on it in the table below** to see the details.\\r\\n\\r\\n**You can rerun playbooks on Insights** that already contain data to get the most recent. \",\"style\":\"upsell\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"0 0 5px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e8613f2c-08c6-49e6-a2c6-e12d185c6bd3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResourceTypes\",\"label\":\"Resource Types\",\"type\":7,\"description\":\"This parameter must be set to Logic app.\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"includeAll\":true,\"showDefault\":false},\"value\":[\"microsoft.logic/workflows\"]},{\"id\":\"4a15b858-69b6-4198-abfd-6af5f187d813\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SentinelResourceGroup\",\"label\":\"Incidents Resource Group\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"Resources\\r\\n| where type in~ ({ResourceTypes})\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"7783c2b4-a6e6-4117-92ec-a9a751f01465\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"isGlobal\":true,\"query\":\"where type =~ \\\"microsoft.operationalinsights/workspaces\\\"\\r\\n| where resourceGroup =~ \\\"{SentinelResourceGroup}\\\"\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0a92b010-8b48-4601-872f-83e13561b088\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"63c75027-cc56-4958-9296-e0c986ab11e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PlaybookResourceGroup\",\"label\":\"Playbook Resource Group\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| where type in~ ({ResourceTypes})\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"3c6d99b2-1eb1-4650-a3f0-d48dc03f87cb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TenantID\",\"label\":\"Tenant ID\",\"type\":1,\"isRequired\":true,\"value\":\"\"},{\"id\":\"e1ea6f58-cd1b-4807-a7de-7da91b787bd4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PlaybookName\",\"label\":\"Playbook\",\"type\":5,\"description\":\"Set the playbook to run when clicking on the \\\"Run Playbook\\\" in the SOC Insight Incidents table below.\",\"isRequired\":true,\"query\":\"Resources\\r\\n| where type in~({ResourceTypes})\\r\\n| extend resourceGroupId = strcat('/subscriptions/', subscriptionId, '/resourceGroups/', resourceGroup)\\r\\n| where resourceGroup =~ \\\"{PlaybookResourceGroup}\\\"// or '*' in~({PlaybookResourceGroup})\\r\\n| order by name asc\\r\\n| extend Rank = row_number()\\r\\n| project label = tostring(name)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"Infoblox-SOC-Get-Insight-Details\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 0 - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **SOC Insight Incident** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 15\",\"styleSettings\":{\"padding\":\"15px 0 0 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"103f5c4e-6007-46c3-88ed-74fdb7843acc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"7c4c6733-a2d8-40b1-abf5-7f2d777e814c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SelectPriority\",\"label\":\"Priority\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n    { \\\"value\\\":\\\"N/A\\\"},\\r\\n    { \\\"value\\\":\\\"INFO\\\"},\\r\\n    { \\\"value\\\":\\\"LOW\\\"},\\r\\n    { \\\"value\\\":\\\"MEDIUM\\\"},\\r\\n    { \\\"value\\\":\\\"HIGH\\\"},\\r\\n     { \\\"value\\\":\\\"CRITICAL\\\"}\\r\\n]\",\"defaultValue\":\"value::all\",\"value\":[\"value::all\"]},{\"id\":\"3e3ee805-c983-480e-9c10-49a47be4ddc6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Status\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityIncident\\r\\n| where CreatedTime {TimeRange:value}\\r\\n| distinct Status\\r\\n| sort by Status asc\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1c79577f-a4f2-4b2a-aaa7-fbcc5e27831d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Owner\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityIncident\\r\\n| where CreatedTime {TimeRange:value}\\r\\n| where Status in ({Status})\\r\\n| project Owner=tostring(Owner.userPrincipalName)\\r\\n| sort by Owner asc\\r\\n| extend Owner = iff(isnotempty( Owner), Owner, \\\"Unassigned\\\")\\r\\n| distinct Owner\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 19 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let x =\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| extend IncidentID = IncidentName\\r\\n| extend IncidentNumber = toint(IncidentNumber)\\r\\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \\\"Unassigned\\\" in ({Owner}))\\r\\n| extend RunPlaybook = \\\"Run Playbook\\\"\\r\\n| where Title has_cs \\\"Infoblox - SOC Insight\\\"\\r\\n| extend Labels = tostring(Labels)\\r\\n| extend InfobloxInsightID = extract(\\\"InfobloxInsightID: (.*?)\\\\\\\"\\\", 1, Labels)\\r\\n| join \\r\\n    (InfobloxInsight\\r\\n    | summarize arg_max(TimeGenerated, *) by InfobloxInsightID\\r\\n    ) on InfobloxInsightID\\r\\n//sometimes duplicate TimeGenerated so grab LastSeen next\\r\\n| summarize arg_max(LastSeen, *) by IncidentNumber\\r\\n| project IncidentNumber, Severity, Priority, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID\\r\\n; \\r\\nlet incidents =\\r\\nSecurityIncident\\r\\n| summarize arg_max(TimeGenerated,*) by tostring(IncidentNumber)\\r\\n| extend IncidentID = IncidentName\\r\\n| extend IncidentNumber = toint(IncidentNumber)\\r\\n| where tostring(Owner.userPrincipalName) in ({Owner}) or (isempty(tostring(Owner.userPrincipalName)) and \\\"Unassigned\\\" in ({Owner}))\\r\\n| extend RunPlaybook = \\\"Run Playbook\\\"\\r\\n| where Title has_cs \\\"Infoblox - SOC Insight\\\"\\r\\n| extend Alerts = extract(\\\"\\\\\\\\[(.*?)\\\\\\\\]\\\", 1, tostring(AlertIds))\\r\\n| mv-expand AlertIds to typeof(string)\\r\\n//----------------\\r\\n;\\r\\nlet alerts =\\r\\n    SecurityAlert\\r\\n    | extend AlertEntities = parse_json(Entities)\\r\\n    //| extend InfobloxInsightID = tostring(AlertEntities.ObjectGuid)\\r\\n;\\r\\nincidents | join alerts on $left.AlertIds == $right.SystemAlertId\\r\\n//----------------------\\r\\n| summarize AlertCount=dcount(AlertIds) by IncidentNumber, IncidentID, Status, Title,  Alerts, IncidentUrl, Owner=tostring(Owner.userPrincipalName) , RunPlaybook\\r\\n// -------------\\r\\n| join kind=inner (incidents | join alerts on $left.AlertIds == $right.SystemAlertId) on IncidentNumber\\r\\n| join kind=fullouter x on IncidentNumber\\r\\n| summarize arg_max(TimeGenerated,*) by (IncidentNumber)\\r\\n//| where Priority in ({SelectPriority}) or '{SelectPriority:label}' ==  \\\"All\\\"\\r\\n| where Status in ({Status}) or '{Status:label}' ==  \\\"All\\\"\\r\\n| project IncidentNumber, Severity, Priority, Title, Status, Owner, IncidentUrl, RunPlaybook, ThreatType, ThreatClass, ThreatFamily, LastSeen, FirstSeen, FeedSource, EventsCount, NotBlockedCount, BlockedCount, PersistentDate, SpreadingDate, InfobloxInsightID, IncidentID\\r\\n//| project-away IncidentID\\r\\n| order by toint(IncidentNumber) desc\\r\\n\",\"size\":0,\"title\":\"SOC Insight Incidents\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"InfobloxInsightID\",\"parameterName\":\"InfobloxInsightID\",\"parameterType\":1},{\"fieldName\":\"IncidentID\",\"parameterName\":\"IncidentID\",\"parameterType\":1},{\"fieldName\":\"Title\",\"parameterName\":\"Title\",\"parameterType\":1}],\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Informational\",\"representation\":\"Sev4\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"unknown\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Priority\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"INFO\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"LOW\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"MEDIUM\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"HIGH\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"CRITICAL\",\"representation\":\"purple\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Status\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"New\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Active\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Owner\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open Incident\"}},{\"columnMatch\":\"RunPlaybook\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"ArmAction\",\"linkIsContextBlade\":true,\"armActionContext\":{\"path\":\"/subscriptions/{Subscription:id}/resourceGroups/{PlaybookResourceGroup:label}/providers/Microsoft.OperationalInsights/workspaces/{Workspace:label}/providers/Microsoft.SecurityInsights/incidents/{IncidentID}/runPlaybook?api-version=2019-01-01-preview\",\"body\":\"{\\r\\n \\\"LogicAppsResourceId\\\":\\\"/subscriptions/{Subscription:id}/resourceGroups/{PlaybookResourceGroup:label}/providers/Microsoft.Logic/workflows/{PlaybookName:label}\\\",\\r\\n \\\"tenantId\\\":\\\"{TenantID}\\\"\\r\\n}\",\"httpMethod\":\"POST\",\"description\":\"# Actions can potentially modify resources.\\n## Please use caution and include a confirmation message in this description when authoring this command.\"}},\"tooltipFormat\":{\"tooltip\":\"Run {PlaybookName} on this insight.\"}},{\"columnMatch\":\"EventsCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"NotBlockedCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"BlockedCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"InsightDataReady\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Data Not Found\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Ready\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"To see data for this insight, run the  Infoblox-SOC-API-Get-Insight-Details playbook.\"}},{\"columnMatch\":\"isPopulated\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Ready\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Data Not Found\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"To see data about this Insight, run the Infoblox-SOC-API-Get-Insight-Details Playbook.\"}},{\"columnMatch\":\"Alerts\",\"formatter\":5},{\"columnMatch\":\"AlertCount\",\"formatter\":0,\"formatOptions\":{\"aggregation\":\"Sum\"}},{\"columnMatch\":\"Entities\",\"formatter\":1},{\"columnMatch\":\"alertCount\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},{\"columnMatch\":\"count_AlertCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"greenRed\"}}],\"rowLimit\":500,\"filter\":true}},\"name\":\"IncidentDetailsView\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Summary\",\"subTarget\":\"Summary\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Assets\",\"subTarget\":\"Assets\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators\",\"subTarget\":\"Indicators\",\"style\":\"link\"},{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events\",\"subTarget\":\"Events\",\"style\":\"link\"},{\"id\":\"03782b90-e744-4654-95c3-a1056cfe78f9\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Comments\",\"subTarget\":\"Comments\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"},\"name\":\"links - 16\",\"styleSettings\":{\"padding\":\"20px 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"#### Click on **SOC Insight Incident** above to view more information.\",\"style\":\"upsell\"},\"conditionalVisibility\":{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isEqualTo\"},\"name\":\"text - 14\",\"styleSettings\":{\"padding\":\"10px 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## {Title}\"},\"name\":\"text - 8\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"5c15d5ff-4108-4538-930b-201f4f8da870\",\"cellValue\":\"https://csp.infoblox.com/#/insights-console/insight/{InfobloxInsightID}/summary\",\"linkTarget\":\"Url\",\"linkLabel\":\"Redirect To Summary on CSP\",\"preText\":\"\",\"style\":\"link\"}]},\"name\":\"links - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(LastSeen)\\r\\n| extend format_datetime(todatetime(FirstSeen), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend FirstSeen = strcat(tostring(FirstSeen), \\\" UTC\\\")\\r\\n| project FirstSeen\",\"size\":3,\"title\":\"First Seen\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"FirstSeen\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"First Seen\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(LastSeen)\\r\\n| extend format_datetime(todatetime(LastSeen), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend LastSeen = strcat(tostring(LastSeen), \\\" UTC\\\")\\r\\n| project LastSeen\",\"size\":3,\"title\":\"Last Seen \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"LastSeen\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Last Seen\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(SpreadingDate)\\r\\n| extend format_datetime(todatetime(SpreadingDate), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend SpreadingDate = strcat(tostring(SpreadingDate), \\\" UTC\\\")\\r\\n| project SpreadingDate\",\"size\":3,\"title\":\"Spreading Date\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"SpreadingDate\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Spreading Date\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(PersistentDate)\\r\\n| extend format_datetime(todatetime(PersistentDate), 'M/dd/yyyy, h:mm:ss tt')\\r\\n| extend PersistentDate = strcat(tostring(PersistentDate), \\\" UTC\\\")\\r\\n| project PersistentDate\",\"size\":3,\"title\":\"Persistent Date\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"PersistentDate\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"25\",\"name\":\"Persistent Date\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(BlockedCount)\\r\\n| project BlockedCount\",\"size\":3,\"title\":\"Blocked Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"BlockedCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Blocked Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(NotBlockedCount)\\r\\n| project NotBlockedCount\",\"size\":3,\"title\":\"Not Blocked Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"NotBlockedCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Not Blocked Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsight\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *)\\r\\n| where isnotempty(EventsCount)\\r\\n| project EventsCount\\r\\n\",\"size\":3,\"title\":\"Total Hits\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"EventsCount\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"gray\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where SourceIP in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP\\r\\n\",\"size\":0,\"title\":\"Top 20 Compromised Assets\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Top Impacted IPs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| summarize count() by ThreatIndicator\\r\\n| top 20 by count_ \\r\\n| project ThreatIndicator);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, ThreatIndicator, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatIndicator\\r\\n\",\"size\":0,\"title\":\"Top 20 Indicators\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Top 20 Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() );\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d\",\"size\":0,\"title\":\"Events\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\"},\"customWidth\":\"33\",\"name\":\"Events\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Summary\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Summary\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Assets\\r\\n---\\r\\nSee your protected assets/devices affected by this insight. **Install the Infoblox Endpoint client for more accurate data.**\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **Asset** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"15px 0 15px 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| join\\r\\n(\\r\\n    InfobloxInsightAssets\\r\\n    | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n) on SourceIP\\r\\n| order by LastSeen, EventCount desc\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['OS Version'] = InfobloxB1SrcOSVersion, Network = InfobloxB1Network, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| project SourceIP, User, ['MAC Address'], ['OS Version'], DeviceName, Network,['DHCP Fingerprint'], Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":1,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"SourceIP\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"IndicatorDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purpleBlue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"EventCount\",\"label\":\"Associated Events\"},{\"columnId\":\"IndicatorDistinctCount\",\"label\":\"Associated Indicators\"}]}},\"name\":\"Assets\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {SourceIP}\",\"styleSettings\":{\"margin\":\"0 60px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize count() by ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ThreatIndicator, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| summarize Count = count() by ThreatIndicator\\r\\n| order by Count desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\" Indicators for {SourceIP}\",\"styleSettings\":{\"margin\":\"0 15px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by ThreatLevel\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Level Trend for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"linechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Threat Level Trend for {SourceIP}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction\",\"size\":0,\"showAnalytics\":true,\"title\":\"Action Trend for {SourceIP}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Not Blocked\",\"color\":\"red\"},{\"seriesName\":\"Log\",\"color\":\"blue\"}]}},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Action Trend for {SourceIP}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where SourceIP == '{SourceIP}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected > ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Events = count() default = 0 on Detected from ago(Lookback) to now() step 1d\",\"size\":0,\"title\":\"All Events for {SourceIP}\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"areachart\"},\"customWidth\":\"33\",\"conditionalVisibility\":{\"parameterName\":\"SourceIP\",\"comparison\":\"isNotEqualTo\"},\"name\":\"All Events for {SourceIP}\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Assets\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Assets\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Indicators\\r\\n---\\r\\nAn **Indicator** is a domain or IP address that is seen in the resolution chain of a query from a device.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(InfobloxB1PolicyAction)\\r\\n| summarize count_distinct(ThreatIndicator) by InfobloxB1PolicyAction\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Not Blocked\",\"color\":\"red\"},{\"seriesName\":\"Blocked\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| summarize count_distinct(ThreatIndicator) by ThreatLevel\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"query - 8 - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### Click on **Indicator** below to view more information.\",\"style\":\"upsell\"},\"name\":\"text - 7\",\"styleSettings\":{\"padding\":\"15px 0 15px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"InfobloxB1PolicyActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"InfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct InfobloxB1PolicyAction\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AssetCount = (InfobloxInsightIndicators\\r\\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\\r\\n| join kind=inner\\r\\n(\\r\\nInfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by SourceIP, ThreatIndicator\\r\\n) on $left.InfobloxInsightID == $right.InfobloxInsightID\\r\\n| where ThreatIndicator1 has_cs ThreatIndicator\\r\\n| summarize by SourceIP, ThreatIndicator\\r\\n| summarize ['Unique Asset Count'] = count() by ThreatIndicator);\\r\\n\\r\\n\\r\\nInfobloxInsightIndicators\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(ThreatIndicator)\\r\\n| where InfobloxB1PolicyAction in ({InfobloxB1PolicyActionParam}) or '{InfobloxB1PolicyActionParam:label}' ==  \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' ==  \\\"All\\\"\\r\\n| join\\r\\n    (\\r\\n        AssetCount\\r\\n    ) on ThreatIndicator\\r\\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\\r\\n| extend URL = strcat(\\\"https://csp.infoblox.com/#/security_research/search/auto/\\\", ThreatIndicator, \\\"/summary\\\")\\r\\n| extend sort_order = case(\\r\\n    ThreatLevel == \\\"High\\\", 5,\\r\\n    ThreatLevel == \\\"Medium\\\", 4,\\r\\n    ThreatLevel == \\\"Low\\\", 3,\\r\\n    ThreatLevel == \\\"N/A\\\", 2,\\r\\n    1 // default case if ThreatLevel doesn't match any of the above\\r\\n)\\r\\n| order by sort_order, EventCount desc\\r\\n| project-away sort_order\\r\\n| project-rename ['Policy Action'] = InfobloxB1PolicyAction, ['Feed Name'] = InfobloxB1FeedName\\r\\n| project ThreatIndicator, ['Unique Asset Count'], ['Policy Action'], ThreatLevel, ThreatConfidence, ['Feed Name'], ThreatActor, LastSeen, FirstSeen, EventCount, URL\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"ThreatIndicator\",\"exportParameterName\":\"ThreatIndicator\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Blocked\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Blocked\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Investigate in Dossier\"}},{\"columnMatch\":\"SourceIPDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"bluePurple\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"EventCount\",\"label\":\"Associated Events\"},{\"columnId\":\"URL\",\"label\":\"Investigate in Dossier\"}]}},\"name\":\"Indicators\",\"styleSettings\":{\"margin\":\"0 15px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| join\\r\\n(\\r\\n    InfobloxInsightAssets\\r\\n    | summarize arg_max(TimeGenerated, *) by SourceIP, SourceUserName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n) on SourceIP\\r\\n| order by LastSeen, EventCount desc\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['Source OSVersion'] = InfobloxB1SrcOSVersion, Network = InfobloxB1Network, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| summarize by SourceIP, User, ['MAC Address'], ['Source OSVersion'], DeviceName, Network, ['DHCP Fingerprint'], Location, EventCount, IndicatorDistinctCount, LastSeen, FirstSeen\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Assets for {ThreatIndicator}\",\"noDataMessage\":\"Select an Indicator in the above chart to see details.\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"IndicatorDistinctCount\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purpleBlue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Assets for {ThreatIndicator}\",\"styleSettings\":{\"margin\":\"0 20px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 500 by count_ \\r\\n);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where SourceIP in ((Top))\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Total= count() default = 0 on Detected from ago(Lookback) to now() step 1d by SourceIP\",\"size\":0,\"showAnalytics\":true,\"title\":\"Source IPs for {ThreatIndicator}\",\"color\":\"amethyst\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"createOtherGroup\":15}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Source IPs for {ThreatIndicator}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where Detected >= ago(30d)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| project-rename User = SourceUserName, ['MAC Address'] = SourceMACAddress, ['Query Type'] = InfobloxDNSQType, ['Policy Name'] = InfobloxB1PolicyName, ['Policy Action'] = InfobloxB1PolicyAction, Network = InfobloxB1Network, FeedName = InfobloxB1FeedName, ['Source OSVersion'] = InfobloxB1SrcOSVersion, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint, ['Date Time'] = TimeGenerated\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ['Query Type'], ThreatClass, User, DeviceName, SourceIP, ThreatProperty, ['Policy Name'], ['Policy Action'], Network, DNSResponse, DNSView, FeedName, ['MAC Address'], ['Source OSVersion'], ['DHCP Fingerprint'], ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {ThreatIndicator}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {ThreatIndicator}\",\"styleSettings\":{\"margin\":\"0 20px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Lookback = 30d;\\r\\nInfobloxInsightEvents\\r\\n| where Detected >= ago(Lookback)\\r\\n| where ThreatIndicator has_cs '{ThreatIndicator}'\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, SourceUserName, DeviceName, SourceIP, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion\\r\\n| make-series Trend = count() default = 0 on Detected from ago(Lookback) to now() step 1d by InfobloxB1PolicyAction\",\"size\":0,\"showAnalytics\":true,\"title\":\"Action Trend for {ThreatIndicator}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":500,\"filter\":true},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Allow - No Log\",\"color\":\"red\"},{\"seriesName\":\"Log\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"ThreatIndicator\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Action Trend for {ThreatIndicator}\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Indicators\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Indicators\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events\\r\\n---\\r\\nDNS security events associated with this insight.\\r\\n\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatLevel)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatLevel\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Level\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"33\",\"name\":\"Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatClass)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatClass\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Classes\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(ThreatProperty)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by ThreatProperty\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Threat Families\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Threat Families\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by SourceUserName\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Users\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where isnotempty(DeviceName)\\r\\n| where Detected >= ago(30d)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceName\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Names\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Device Names\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(SourceIP)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by SourceIP\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Source IPs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1Network)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1Network\",\"size\":4,\"title\":\"Sources\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1PolicyName)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1PolicyName\",\"size\":4,\"title\":\"Policies\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Policies\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(InfobloxB1PolicyAction)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by InfobloxB1PolicyAction\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Actions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Block\",\"color\":\"green\"},{\"seriesName\":\"Log\",\"color\":\"lightBlue\"},{\"seriesName\":\"Allow - No Log\",\"color\":\"red\"}]}},\"customWidth\":\"33\",\"name\":\"Actions\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DNSResponse)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DNSResponse\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"DNS Responses\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"DNS Responses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DeviceRegion)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceRegion\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Regions\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"Device Regions\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| where isnotempty(DeviceCountry)\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, InfobloxDNSQType, ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, InfobloxB1PolicyName, InfobloxB1PolicyAction, InfobloxB1Network, DNSResponse, DNSView, InfobloxB1FeedName, SourceMACAddress, InfobloxB1SrcOSVersion, InfobloxB1DHCPFingerprint, ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| summarize Count = count() by DeviceCountry\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Device Countries\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"}]}},\"customWidth\":\"33\",\"name\":\"Device Countries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightEvents\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| where Detected >= ago(30d)\\r\\n| project-rename ['Query Type'] = InfobloxDNSQType, ['Policy Name'] = InfobloxB1PolicyName, ['Policy Action'] = InfobloxB1PolicyAction, Network = InfobloxB1Network, FeedName = InfobloxB1FeedName, ['Source OSVersion'] = InfobloxB1SrcOSVersion, ['DHCP Fingerprint'] = InfobloxB1DHCPFingerprint\\r\\n| distinct ThreatLevel, ThreatConfidence, Detected, DestinationDnsDomain, ['Query Type'], ThreatClass, SourceUserName, DeviceName, SourceIP, ThreatProperty, ['Policy Name'], ['Policy Action'], Network, DNSResponse, DNSView, FeedName, SourceMACAddress, ['Source OSVersion'], ['DHCP Fingerprint'], ResponseRegion, ResponseCountry, DeviceRegion, DeviceCountry\\r\\n| order by Detected desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"InfobloxB1PolicyAction\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Block\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Events\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxInsightComments\\r\\n| where InfobloxInsightID == \\\"{InfobloxInsightID}\\\"\\r\\n| distinct  CommentChanger, Comment, DateChanged, Status\\r\\n| order by DateChanged desc\\r\\n| project-rename ['Date Time'] = DateChanged, User = CommentChanger\\r\\n| project ['Date Time'], Status, User, Comment\",\"size\":0,\"title\":\"Comments\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"name\":\"Comments\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Comments\"},{\"parameterName\":\"InfobloxInsightID\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Comments\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 17\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"6\"},\"name\":\"group - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This Config Insights depends on the **Infoblox-Config-Insights** and **InfoBlox-Config-Insight-Details** logic apps which are deployed with the Microsoft Sentinel Solution.</br>\\r\\nPlease configure this logic apps first and keep it enabled in order to use this Config Insight Details Dashboard.\\r\\n\",\"style\":\"info\"},\"name\":\"text - 4\"},{\"type\":1,\"content\":{\"json\":\"# Infoblox Config Insights\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Steps to view Config Insights Details using this workbook\\r\\n- This workbook is intended to view the available config insights and view their details.\\r\\n- Select the **Resource Group** and **Subscription ID**.\\r\\n- Select TimeRange.\\r\\n- From the **Config Insights** panel, select any config Insight.\\r\\n- You will be able to see the config details of the selected Insight.\\r\\n- If there is message like **The query returned no results** on config details panel, then click on the **GET CONFIG INSIGHT DETAILS** link to get the Config Insight Details for that Config Insight.\\r\\n- This will execute the **InfoBlox-Config-Insight-Details** logic app in the background.\\r\\n- You can check the status of the playbook to identify the Config Insight Details status.\\r\\n- Click on the refresh button of the lookup panel until you get the Config Insight Details.\\r\\n</br>\\r\\n</br>\\r\\n**Note** : In cases where specific indicators may not have lookup information available in Infoblox, users are advised to refer to the Logic App status for further details.\\r\\n\",\"style\":\"upsell\"},\"name\":\"text - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7783c2b4-a6e6-4117-92ec-a9a751f01465\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SubscriptionId\",\"label\":\"Subscription ID\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| distinct subscriptionId\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"4a15b858-69b6-4198-abfd-6af5f187d813\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SentinelResourceGroup1\",\"label\":\"Resource Group\",\"type\":2,\"isRequired\":true,\"query\":\"Resources\\r\\n| summarize Count = count() by subscriptionId, resourceGroup\\r\\n| where subscriptionId == ('{SubscriptionId}')\\r\\n| order by Count desc\\r\\n| extend Rank = row_number()\\r\\n| project resourceGroup\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"\"},{\"id\":\"f70e5d0e-2eff-4bca-9489-90ab64378887\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000}],\"allowCustom\":false},\"value\":{\"durationMs\":1209600000},\"label\":\"Time Range\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"name\":\"parameters - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, policyAnalyticsId_g:string) [];\\r\\nunion isfuzzy = true\\r\\ndummy_table,\\r\\nInfoblox_Config_Insights_CL\\r\\n| summarize arg_max(TimeGenerated, *) by policyAnalyticsId_g\\r\\n| extend ConfigInsightDetails = \\\"GET CONFIG INSIGHT DETAILS\\\"\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'],\\r\\n['Policy Analytics ID'] = policyAnalyticsId_g,\\r\\n['Insight Type'] = column_ifexists(\\\"insightType_s\\\",\\\"\\\"),\\r\\n[\\\"Config Insight Details\\\"] = column_ifexists(\\\"ConfigInsightDetails\\\",\\\"\\\")\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Config Insights\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"exportFieldName\":\"Policy Analytics ID\",\"exportParameterName\":\"ConfigInsightId\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Config Insight Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"ArmAction\",\"linkIsContextBlade\":true,\"armActionContext\":{\"path\":\"/subscriptions/{SubscriptionId}/resourceGroups/{SentinelResourceGroup1}/providers/Microsoft.Logic/workflows/InfoBlox-Config-Insight-Details/triggers/manual/run?api-version=2016-10-01\",\"body\":\"{\\r\\n  \\\"config_insight_id\\\": \\\"{ConfigInsightId}\\\"\\r\\n}\",\"httpMethod\":\"POST\",\"description\":\"# Actions can potentially modify resources.\\n## Please use caution and include a confirmation message in this description when authoring this command.\"}}}],\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"Policy Analytics ID\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Policy Analytics ID\",\"sortOrder\":1}]},\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let dummy_table = datatable(TimeGenerated: datetime, analyticInsightId_g:string, feeds_s:string) [];\\r\\nunion isfuzzy = true\\r\\ndummy_table,\\r\\nInfoblox_Config_Insight_Details_CL\\r\\n| where analyticInsightId_g == \\\"{ConfigInsightId}\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by analyticInsightId_g\\r\\n| extend ParsedJson = parse_json(feeds_s)\\r\\n| mv-expand ParsedJson\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], \\r\\n['Insight Type'] = insightType_s,\\r\\n['Rule Type'] = ParsedJson.ruleType, \\r\\n['Rule Name'] = ParsedJson.ruleName, \\r\\n['Feed Name'] = ParsedJson.feedName, \\r\\n['Current Action'] = ParsedJson.currentAction, \\r\\n['Recommended Action'] = ParsedJson.recommendedAction, \\r\\n['Status'] = ParsedJson.status\",\"size\":0,\"showAnalytics\":true,\"title\":\"Config Insights Detail for Config ID: {ConfigInsightId}\",\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000}},\"conditionalVisibility\":{\"parameterName\":\"ConfigInsightId\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"8\"},\"name\":\"group - 16\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Subscription}\"],\"parameters\":[{\"id\":\"a4b4e975-fa7c-46a3-b669-850aacc88134\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Guide\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n    {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\":true},\\r\\n    {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\"}\\r\\n]\"},{\"id\":\"e6ded9a1-a83c-4762-938d-5bf8ff3d3d38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"e3225ed0-6210-40a1-b2d0-66e42ffa71d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| order by name asc\\r\\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\\r\\n| mvexpand All limit 100\\r\\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"15b2c181-7397-43c1-900a-28e175ae8a6f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContextFromParameter\":\"TimeRange\",\"label\":\"Time Range\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Parameter Selectors\"},{\"type\":1,\"content\":{\"json\":\"<svg viewBox=\\\"0 0 19 19\\\" width=\\\"20\\\" class=\\\"fxt-escapeShadow\\\" role=\\\"presentation\\\" focusable=\\\"false\\\" xmlns:svg=\\\"http://www.w3.org/2000/svg\\\" xmlns:xlink=\\\"http://www.w3.org/1999/xlink\\\" aria-hidden=\\\"true\\\"><g><path fill=\\\"#1b93eb\\\" d=\\\"M16.82 8.886c0 4.81-5.752 8.574-7.006 9.411a.477.477 0 01-.523 0C8.036 17.565 2.18 13.7 2.18 8.886V3.135a.451.451 0 01.42-.419C7.2 2.612 6.154.625 9.5.625s2.3 1.987 6.8 2.091a.479.479 0 01.523.419z\\\"></path><path fill=\\\"url(#0024423711759027356)\\\" d=\\\"M16.192 8.99c0 4.392-5.333 7.947-6.483 8.575a.319.319 0 01-.418 0c-1.15-.732-6.483-4.183-6.483-8.575V3.762a.575.575 0 01.313-.523C7.2 3.135 6.258 1.357 9.4 1.357s2.2 1.882 6.274 1.882a.45.45 0 01.419.418z\\\"></path><path d=\\\"M9.219 5.378a.313.313 0 01.562 0l.875 1.772a.314.314 0 00.236.172l1.957.284a.314.314 0 01.174.535l-1.416 1.38a.312.312 0 00-.09.278l.334 1.949a.313.313 0 01-.455.33l-1.75-.92a.314.314 0 00-.292 0l-1.75.92a.313.313 0 01-.455-.33L7.483 9.8a.312.312 0 00-.09-.278L5.977 8.141a.314.314 0 01.174-.535l1.957-.284a.314.314 0 00.236-.172z\\\" class=\\\"msportalfx-svg-c01\\\"></path></g></svg>&nbsp;<span style=\\\"font-family: Open Sans; font-weight: 620; font-size: 14px;font-style: bold;margin:-10px 0px 0px 0px;position: relative;top:-3px;left:-4px;\\\"> Please take time to answer a quick survey,\\r\\n</span>[<span style=\\\"font-family: Open Sans; font-weight: 620; font-size: 14px;font-style: bold;margin:-10px 0px 0px 0px;position: relative;top:-3px;left:-4px;\\\"> click here. </span>](https://forms.office.com/r/n9beey85aP)\"},\"name\":\"Survey\"},{\"type\":1,\"content\":{\"json\":\"# [Threat Intelligence](https://docs.microsoft.com/azure/sentinel/understand-threat-intelligence)\\n---\\n\\nWithin a Security Information and Event Management (SIEM) solution like Microsoft Sentinel, the most commonly used form of CTI is threat indicators, also known as Indicators of Compromise or IoCs. Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it can be applied to security products and automation in large scale to detect potential threats to an organization and protect against them. In Microsoft Sentinel, you can use threat indicators to help detect malicious activity observed in your environment and provide context to security investigators to help inform response decisions. [Video Demo](https://youtu.be/4Bet2oVODow)\\n\"},\"customWidth\":\"79\",\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Workbook Overview\"},{\"type\":1,\"content\":{\"json\":\"![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) \"},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Microsoft Sentinel Logo\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"18c690d7-7cbd-46c1-b677-1f72692d40cd\",\"cellValue\":\"TAB\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators Ingestion\",\"subTarget\":\"Indicators\",\"preText\":\"Alert rules\",\"style\":\"link\"},{\"id\":\"f88dcf47-af98-4684-9de3-1ee5f48f68fc\",\"cellValue\":\"TAB\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Indicators Search\",\"subTarget\":\"Observed\",\"style\":\"link\"}]},\"name\":\"Tabs link\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\\r\\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \\\"IP\\\",\\r\\n                        iff(isnotempty(Url), \\\"URL\\\",\\r\\n                        iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \\\"Email\\\",\\r\\n                        iff(isnotempty(FileHashValue), \\\"File\\\",\\r\\n                         iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \\\"Domain\\\",\\r\\n                        \\\"Other\\\")))))\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by IndicatorType, bin(TimeGenerated, 1h)\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=stacked \",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Imported into Sentinel by Indicator Type and Date\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by SourceSystem, bin(TimeGenerated, 1h)\\r\\n| render barchart kind=stacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Imported into Sentinel by Indicator Provider and Date\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Create a new column to identify the type of indicator, IP, Domain, URL, File, or Other\\r\\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \\\"IP\\\",\\r\\n                        iff(isnotempty(Url), \\\"URL\\\",\\r\\n                        iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \\\"Email\\\",\\r\\n                        iff(isnotempty(FileHashValue), \\\"File\\\",\\r\\n                         iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \\\"Domain\\\",\\r\\n                        \\\"Other\\\")))))\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by IndicatorType\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=unstacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Indicator Type\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by SourceSystem\\r\\n| order by CountOfIndicators desc \\r\\n| render barchart kind=unstacked\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Indicator Source\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n// Select all indicators from the table\\r\\n| where TimeGenerated < now()\\r\\n// Select only indicators that have not expired\\r\\n    and ExpirationDateTime > now()\\r\\n// Select only indicators that are marked active\\r\\n    and Active == true\\r\\n// Select only the most recently ingested copy of an indicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n// Summarize and order the data, then render the chart\\r\\n| summarize CountOfIndicators = count() by tostring(ConfidenceScore)\\r\\n| order by CountOfIndicators desc \\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Indicators by Confidence Score\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"]},\"customWidth\":\"50\",\"name\":\"query - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DomainQuery=view() { \\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(DomainName)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by DomainName\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"DomainEntry\\\"\\r\\n};\\r\\nlet UrlQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(Url)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by Url\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"UrlEntry\\\"\\r\\n};\\r\\nlet FileHashQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(FileHashValue)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by FileHashValue\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"FileHashEntry\\\"\\r\\n};\\r\\nlet IPQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(NetworkIP) or isnotempty(NetworkSourceIP)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by NetworkIP, NetworkSourceIP\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"IPEntry\\\"\\r\\n};\\r\\nlet EmailAddressQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(EmailSenderAddress)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSenderAddress\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"EmailAddressEntry\\\"\\r\\n};\\r\\nlet EmailMessageQuery=view(){\\r\\nThreatIntelligenceIndicator\\r\\n| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n| where isnotempty(EmailSubject)\\r\\n| summarize SourceSystemArray=make_set(SourceSystem) by EmailSubject\\r\\n| summarize count() by tostring(SourceSystemArray)\\r\\n| project SourceSystemArray, count_, EntryType=\\\"EmailMessageEntry\\\"\\r\\n};\\r\\nlet SingleSourceIndicators=view(){\\r\\n    DomainQuery\\r\\n    | union UrlQuery\\r\\n    | union FileHashQuery\\r\\n    | union IPQuery\\r\\n    | union EmailAddressQuery\\r\\n    | union EmailMessageQuery\\r\\n    | where array_length(todynamic(SourceSystemArray))==1\\r\\n    | summarize sum(count_) by SourceSystemArray\\r\\n    | extend counter=1 \\r\\n};\\r\\nlet MultipleSourceIndicators=view(){\\r\\n    DomainQuery\\r\\n    | union UrlQuery\\r\\n    | union FileHashQuery\\r\\n    | union IPQuery\\r\\n    | union EmailAddressQuery\\r\\n    | union EmailMessageQuery\\r\\n    | where array_length(todynamic(SourceSystemArray))!=1\\r\\n    | summarize sum(count_) by SourceSystemArray\\r\\n    | extend counter=1\\r\\n};\\r\\nlet CountOfActiveIndicatorsBySource=view(){\\r\\n    ThreatIntelligenceIndicator\\r\\n\\t| summarize arg_max(TimeGenerated, *) by IndicatorId\\r\\n    | where ExpirationDateTime > now() and Active == true\\r\\n    | summarize count() by SourceSystem\\r\\n    | project SourceSystem, count_\\r\\n};\\r\\nSingleSourceIndicators\\r\\n| join kind=fullouter MultipleSourceIndicators on counter \\r\\n| where SourceSystemArray contains todynamic(SourceSystemArray)[0] \\r\\n| order by SourceSystemArray\\r\\n| extend solitary_count=sum_count_\\r\\n| summarize shared_count = sum(sum_count_1) by SourceSystemArray, solitary_count\\r\\n| extend total_count = shared_count + solitary_count\\r\\n| extend unique_percentage = round(toreal(solitary_count)/toreal(total_count)*100, 1)\\r\\n| extend IndicatorSource = tostring(todynamic(SourceSystemArray)[0])\\r\\n| join kind=inner CountOfActiveIndicatorsBySource on $left.IndicatorSource == $right.SourceSystem\\r\\n| order by unique_percentage desc\\r\\n| project Source=IndicatorSource, UniquenessPercentage=unique_percentage, ActiveIndicators = count_\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Uniqueness of Threat Intelligence Sources\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Source\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"View\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ActiveIndicators\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 12\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"TAB\",\"comparison\":\"isEqualTo\",\"value\":\"Indicators\"},\"name\":\"Indicators Ingestion\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9aec751b-07bd-43ba-80b9-f711887dce45\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Indicator\",\"label\":\"Search Indicator in Events\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Threat Research Parameters\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"50\",\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Add additional lines for desired data columns\\r\\nunion withsource= Table_Name *\\r\\n| where column_ifexists('CallerIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileOriginUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FQDN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessSHA256', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddresses', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Name', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RecipientEmailAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SenderMailFromAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Url', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SrcIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DstIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkSourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHashValue', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkDestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSourceIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSenderAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DomainName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AADEmail', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Account', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Caller', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CompromisedEntity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DisplayName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Email_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessAccountUpn', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('MailboxOwnerUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Owner', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RequesterUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceIdentity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUser', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Upn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('User_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserId_', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId_s_s', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('userName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserName', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('userPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Computer', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHash', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FilePath', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Process', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CommandLine', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NewProcessName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('ParentProcessName', '') has \\\"{Indicator}\\\"\\r\\n| summarize count() by Table_Name \\r\\n| project-rename ['Data Table']=Table_Name, ['Logs Count']=count_\\r\\n| sort by ['Logs Count'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Observed\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Type\",\"exportParameterName\":\"Type\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Data Table\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Log\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Logs Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Add additional lines for desired data columns\\r\\nunion withsource= Table_Name *\\r\\n| where column_ifexists('CallerIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileOriginUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FQDN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessSHA256', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddresses', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('IPAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Name', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RemoteUrl', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RecipientEmailAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SenderMailFromAddress', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('SourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Url', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SrcIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DstIpAddr', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkSourceIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHashValue', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NetworkDestinationIP', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSourceIpAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('EmailSenderAddress', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DomainName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AADEmail', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Account', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('AccountUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Caller', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CompromisedEntity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DestinationUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('DisplayName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Email_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FullyQualifiedSubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('InitiatingProcessAccountUpn', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('MailboxOwnerUPN', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Owner', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('RequesterUpn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceIdentity', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserID', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SourceUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('SubjectUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUser', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('TargetUserName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Upn', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('User_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserId_', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserId_s_s', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('userName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserName', '') has \\\"{Indicator}\\\" \\r\\nor column_ifexists('UserName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('userPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName_s', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('UserPrincipalName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Computer', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FileHash', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('FilePath', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('Process', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('CommandLine', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('NewProcessName', '') has \\\"{Indicator}\\\"\\r\\nor column_ifexists('ParentProcessName', '') has \\\"{Indicator}\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Type\\r\\n| render areachart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Indicators Observed over Time\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Data Table\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Log\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Logs Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let tiObservables = ThreatIntelligenceIndicator\\r\\n    | where TimeGenerated < now()\\r\\n    | project IndicatorId, ThreatType, Description, Active, IndicatorTime = TimeGenerated, Indicator = strcat(NetworkSourceIP, NetworkIP, NetworkDestinationIP, Url, FileHashValue, EmailSourceIpAddress, EmailSenderAddress, DomainName), SourceSystem;\\r\\nlet alertEntity = SecurityAlert \\r\\n    | project parse_json(Entities), SystemAlertId , AlertTime = TimeGenerated\\r\\n    | mvexpand(Entities)\\r\\n    | extend entity = iif(isnotempty(Entities.Address), Entities.Address,\\r\\n                      iif(isnotempty(Entities.HostName),strcat(Entities.HostName, \\\".\\\", Entities.DnsDomain),\\r\\n                      iif(isnotempty(Entities.Url), Entities.Url,\\r\\n                      iif(isnotempty(Entities.Value), Entities.Value,\\r\\n                      iif(Entities.Type == \\\"account\\\", strcat(Entities.Name,\\\"@\\\",Entities.UPNSuffix),\\\"\\\")))))\\r\\n    | where isnotempty(entity) \\r\\n    | project entity, SystemAlertId, AlertTime;\\r\\nlet IncidentAlerts = SecurityIncident\\r\\n    | project IncidentTime = TimeGenerated, IncidentNumber, Title, parse_json(AlertIds)\\r\\n    | mv-expand AlertIds\\r\\n    | project IncidentTime, IncidentNumber, Title, tostring(AlertIds);\\r\\nlet AlertsWithTiObservables = alertEntity\\r\\n    | join kind=inner tiObservables on $left.entity == $right.Indicator;\\r\\nlet IncidentsWithAlertsWithTiObservables = AlertsWithTiObservables\\r\\n    | join kind=inner IncidentAlerts on $left.SystemAlertId == $right.AlertIds;\\r\\nIncidentsWithAlertsWithTiObservables\\r\\n| where Indicator contains '{Indicator}' or Indicator == \\\"*\\\"\\r\\n| summarize Incidents=dcount(IncidentNumber), Alerts=dcount(SystemAlertId) by Indicator, ThreatType, Source = SourceSystem, Description\\r\\n| sort by Incidents, Alerts desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Intelligence Alerts\",\"noDataMessage\":\"No indicators observed within these thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatType\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Botnet\",\"representation\":\"Command and Control\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"MaliciousUrl\",\"representation\":\"Initial_Access\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Malware\",\"representation\":\"Execution\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Phishing\",\"representation\":\"Exfiltration\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Pre attack\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Source\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Incidents\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Alerts\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}}],\"filter\":true}},\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ThreatIntelligenceIndicator\\r\\n| where TimeGenerated < now()\\r\\n| project-rename ['Date Time'] = TimeGenerated\\r\\n| project ['Date Time'], IndicatorId, ThreatType, Active, Tags, TrafficLightProtocolLevel, EmailSenderAddress, FileHashType, FileHashValue, DomainName, NetworkIP\",\"size\":0,\"showAnalytics\":true,\"title\":\"Threat Intelligence Indicator\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 6\"},{\"type\":1,\"content\":{\"json\":\"📝 ***Refresh the web page to fetch details of recently collected events***\"},\"name\":\"text - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"TAB\",\"comparison\":\"isEqualTo\",\"value\":\"Observed\"},\"name\":\"Indicators Observed\"}]},\"conditionalVisibility\":{\"parameterName\":\"Parameter\",\"comparison\":\"isEqualTo\",\"value\":\"7\"},\"name\":\"group - 7\"}],\"fromTemplateId\":\"sentinel-Infoblox | Infoblox Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
                 "version": "1.0",
                 "sourceId": "[variables('workspaceResourceId')]",
                 "category": "sentinel"
@@ -3257,7 +3257,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-SOCInsight-Detected-APISource_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Infoblox-SOCInsight-Detected-APISource_AnalyticalRules Analytics Rule with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
@@ -3285,10 +3285,10 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "InfobloxSOCInsightsDataConnector_API",
                     "dataTypes": [
                       "InfobloxInsight"
-                    ],
-                    "connectorId": "InfobloxSOCInsightsDataConnector_API"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -3300,15 +3300,16 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "SecurityGroup",
                     "fieldMappings": [
                       {
                         "columnName": "InfobloxInsightID",
                         "identifier": "ObjectGuid"
                       }
-                    ],
-                    "entityType": "SecurityGroup"
+                    ]
                   },
                   {
+                    "entityType": "Malware",
                     "fieldMappings": [
                       {
                         "columnName": "ThreatClass",
@@ -3318,30 +3319,29 @@
                         "columnName": "ThreatProperty",
                         "identifier": "Category"
                       }
-                    ],
-                    "entityType": "Malware"
+                    ]
                   }
                 ],
                 "eventGroupingSettings": {
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "Status": "Status",
-                  "Severity": "Priority",
-                  "PersistentDate": "PersistentDate",
+                  "UnblockedHits": "NotBlockedCount",
                   "BlockedHits": "BlockedCount",
+                  "InfobloxInsightID": "[variables('_Infoblox_Insight_ID')]",
+                  "Severity": "Priority",
                   "FirstSeen": "FirstSeen",
+                  "TotalHits": "EventsCount",
                   "SpreadingDate": "SpreadingDate",
                   "LastSeen": "LastSeen",
                   "FeedSource": "FeedSource",
-                  "InfobloxInsightID": "[variables('_Infoblox_Insight_ID')]",
-                  "TotalHits": "EventsCount",
-                  "UnblockedHits": "NotBlockedCount"
+                  "PersistentDate": "PersistentDate",
+                  "Status": "Status"
                 },
                 "alertDetailsOverride": {
-                  "alertDisplayNameFormat": "Infoblox - SOC Insight - {{ThreatClass}} {{ThreatProperty}}",
                   "alertSeverityColumnName": "IncidentSeverity",
-                  "alertDescriptionFormat": "Observed via API. {{ThreatFamily}}. Last Observation: {{LastSeen}}"
+                  "alertDescriptionFormat": "Observed via API. {{ThreatFamily}}. Last Observation: {{LastSeen}}",
+                  "alertDisplayNameFormat": "Infoblox - SOC Insight - {{ThreatClass}} {{ThreatProperty}}"
                 },
                 "incidentConfiguration": {
                   "createIncident": true
@@ -3397,7 +3397,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-SOCInsight-Detected-CDCSource_AnalyticalRules Analytics Rule with template version 3.0.0",
+        "description": "Infoblox-SOCInsight-Detected-CDCSource_AnalyticalRules Analytics Rule with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
@@ -3425,16 +3425,16 @@
                 "status": "Available",
                 "requiredDataConnectors": [
                   {
+                    "connectorId": "InfobloxSOCInsightsDataConnector_Legacy",
                     "dataTypes": [
                       "CommonSecurityLog (InfobloxCDC_SOCInsights)"
-                    ],
-                    "connectorId": "InfobloxSOCInsightsDataConnector_Legacy"
+                    ]
                   },
                   {
+                    "connectorId": "InfobloxSOCInsightsDataConnector_AMA",
                     "dataTypes": [
                       "CommonSecurityLog (InfobloxCDC_SOCInsights)"
-                    ],
-                    "connectorId": "InfobloxSOCInsightsDataConnector_AMA"
+                    ]
                   }
                 ],
                 "tactics": [
@@ -3446,15 +3446,16 @@
                 ],
                 "entityMappings": [
                   {
+                    "entityType": "SecurityGroup",
                     "fieldMappings": [
                       {
                         "columnName": "InfobloxInsightID",
                         "identifier": "ObjectGuid"
                       }
-                    ],
-                    "entityType": "SecurityGroup"
+                    ]
                   },
                   {
+                    "entityType": "Malware",
                     "fieldMappings": [
                       {
                         "columnName": "ThreatClass",
@@ -3464,25 +3465,24 @@
                         "columnName": "ThreatProperty",
                         "identifier": "Category"
                       }
-                    ],
-                    "entityType": "Malware"
+                    ]
                   }
                 ],
                 "eventGroupingSettings": {
                   "aggregationKind": "AlertPerResult"
                 },
                 "customDetails": {
-                  "Status": "Status",
-                  "UnblockedHits": "NotBlockedCount",
                   "BlockedHits": "BlockedCount",
+                  "InfobloxInsightID": "[variables('_Infoblox_Insight_ID')]",
+                  "Status": "Status",
                   "TotalHits": "EventsCount",
                   "FeedSource": "FeedSource",
-                  "InfobloxInsightID": "[variables('_Infoblox_Insight_ID')]"
+                  "UnblockedHits": "NotBlockedCount"
                 },
                 "alertDetailsOverride": {
-                  "alertDisplayNameFormat": "Infoblox - SOC Insight - {{ThreatClass}} {{ThreatProperty}}",
                   "alertSeverityColumnName": "IncidentSeverity",
-                  "alertDescriptionFormat": "Observed via CDC. {{ThreatFamily}}. {{Message}}"
+                  "alertDescriptionFormat": "Observed via CDC. {{ThreatFamily}}. {{Message}}",
+                  "alertDisplayNameFormat": "Infoblox - SOC Insight - {{ThreatClass}} {{ThreatProperty}}"
                 },
                 "incidentConfiguration": {
                   "createIncident": true
@@ -3538,7 +3538,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxCDC_SOCInsights Data Parser with template version 3.0.0",
+        "description": "InfobloxCDC_SOCInsights Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject1').parserVersion1]",
@@ -3666,7 +3666,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxInsight Data Parser with template version 3.0.0",
+        "description": "InfobloxInsight Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject2').parserVersion2]",
@@ -3794,7 +3794,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxInsightAssets Data Parser with template version 3.0.0",
+        "description": "InfobloxInsightAssets Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject3').parserVersion3]",
@@ -3922,7 +3922,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxInsightComments Data Parser with template version 3.0.0",
+        "description": "InfobloxInsightComments Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject4').parserVersion4]",
@@ -4050,7 +4050,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxInsightEvents Data Parser with template version 3.0.0",
+        "description": "InfobloxInsightEvents Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject5').parserVersion5]",
@@ -4178,7 +4178,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "InfobloxInsightIndicators Data Parser with template version 3.0.0",
+        "description": "InfobloxInsightIndicators Data Parser with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('parserObject6').parserVersion6]",
@@ -4306,7 +4306,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Block-Allow-IP-Domain Playbook with template version 3.0.0",
+        "description": "Infoblox-Block-Allow-IP-Domain Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion1')]",
@@ -5010,7 +5010,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Block-Allow-IP-Domain-Incident-Based Playbook with template version 3.0.0",
+        "description": "Infoblox-Block-Allow-IP-Domain-Incident-Based Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion2')]",
@@ -6055,7 +6055,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Config-Insight-Details Playbook with template version 3.0.0",
+        "description": "Infoblox-Config-Insight-Details Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion3')]",
@@ -6413,7 +6413,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Config-Insights Playbook with template version 3.0.0",
+        "description": "Infoblox-Config-Insights Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion4')]",
@@ -6873,7 +6873,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Data-Connector-Trigger-Sync Playbook with template version 3.0.0",
+        "description": "Infoblox-Data-Connector-Trigger-Sync Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion5')]",
@@ -7584,7 +7584,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-DHCP-Lookup Playbook with template version 3.0.0",
+        "description": "Infoblox-DHCP-Lookup Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion6')]",
@@ -8417,7 +8417,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Get-IP-Space-Data Playbook with template version 3.0.0",
+        "description": "Infoblox-Get-IP-Space-Data Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion7')]",
@@ -9313,7 +9313,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Get-Service-Name Playbook with template version 3.0.0",
+        "description": "Infoblox-Get-Service-Name Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion8')]",
@@ -9852,7 +9852,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-IPAM-Lookup Playbook with template version 3.0.0",
+        "description": "Infoblox-IPAM-Lookup Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion9')]",
@@ -11888,7 +11888,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-SOC-Get-Insight-Details Playbook with template version 3.0.0",
+        "description": "Infoblox-SOC-Get-Insight-Details Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion10')]",
@@ -12832,7 +12832,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-SOC-Get-Open-Insights-API Playbook with template version 3.0.0",
+        "description": "Infoblox-SOC-Get-Open-Insights-API Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion11')]",
@@ -13130,7 +13130,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-SOC-Import-Indicators-TI Playbook with template version 3.0.0",
+        "description": "Infoblox-SOC-Import-Indicators-TI Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion12')]",
@@ -13755,7 +13755,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-TIDE-Lookup Playbook with template version 3.0.0",
+        "description": "Infoblox-TIDE-Lookup Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion13')]",
@@ -14524,7 +14524,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-TIDE-Lookup-Via-Incident Playbook with template version 3.0.0",
+        "description": "Infoblox-TIDE-Lookup-Via-Incident Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion14')]",
@@ -15264,7 +15264,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-TIDE-Lookup-Comment-Enrichment Playbook with template version 3.0.0",
+        "description": "Infoblox-TIDE-Lookup-Comment-Enrichment Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion15')]",
@@ -16837,7 +16837,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-TimeRangeBased-DHCP-Lookup Playbook with template version 3.0.0",
+        "description": "Infoblox-TimeRangeBased-DHCP-Lookup Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion16')]",
@@ -17891,7 +17891,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "Infoblox-Get-Host-Name Playbook with template version 3.0.0",
+        "description": "Infoblox-Get-Host-Name Playbook with template version 3.0.1",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion17')]",
@@ -18431,7 +18431,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.0.0",
+        "version": "3.0.1",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "Infoblox",
diff --git a/Solutions/Infoblox/Workbooks/Infoblox_Workbook.json b/Solutions/Infoblox/Workbooks/Infoblox_Workbook.json
index 477109ffdd8..0bb70edba80 100644
--- a/Solutions/Infoblox/Workbooks/Infoblox_Workbook.json
+++ b/Solutions/Infoblox/Workbooks/Infoblox_Workbook.json
@@ -5540,7 +5540,7 @@
                   "type": 3,
                   "content": {
                     "version": "KqlItem/1.0",
-                    "query": "let AssetCount = (InfobloxInsightIndicators\r\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\r\n| join kind=inner\r\n(\r\nInfobloxInsightEvents\r\n| where InfobloxInsightID == \"66b112e0-3187-4faa-9357-d229e98002ca\"\r\n| summarize arg_max(TimeGenerated, *) by SourceIP, ThreatIndicator\r\n) on $left.InfobloxInsightID == $right.InfobloxInsightID\r\n| where ThreatIndicator1 has_cs ThreatIndicator\r\n| summarize by SourceIP, ThreatIndicator\r\n| summarize ['Unique Asset Count'] = count() by ThreatIndicator);\r\n\r\n\r\nInfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(ThreatIndicator)\r\n| where InfobloxB1PolicyAction in ({InfobloxB1PolicyActionParam}) or '{InfobloxB1PolicyActionParam:label}' ==  \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' ==  \"All\"\r\n| join\r\n    (\r\n        AssetCount\r\n    ) on ThreatIndicator\r\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\r\n| extend URL = strcat(\"https://csp.infoblox.com/#/security_research/search/auto/\", ThreatIndicator, \"/summary\")\r\n| extend sort_order = case(\r\n    ThreatLevel == \"High\", 5,\r\n    ThreatLevel == \"Medium\", 4,\r\n    ThreatLevel == \"Low\", 3,\r\n    ThreatLevel == \"N/A\", 2,\r\n    1 // default case if ThreatLevel doesn't match any of the above\r\n)\r\n| order by sort_order, EventCount desc\r\n| project-away sort_order\r\n| project-rename ['Policy Action'] = InfobloxB1PolicyAction, ['Feed Name'] = InfobloxB1FeedName\r\n| project ThreatIndicator, ['Unique Asset Count'], ['Policy Action'], ThreatLevel, ThreatConfidence, ['Feed Name'], ThreatActor, LastSeen, FirstSeen, EventCount, URL\r\n\r\n",
+                    "query": "let AssetCount = (InfobloxInsightIndicators\r\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\r\n| join kind=inner\r\n(\r\nInfobloxInsightEvents\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| summarize arg_max(TimeGenerated, *) by SourceIP, ThreatIndicator\r\n) on $left.InfobloxInsightID == $right.InfobloxInsightID\r\n| where ThreatIndicator1 has_cs ThreatIndicator\r\n| summarize by SourceIP, ThreatIndicator\r\n| summarize ['Unique Asset Count'] = count() by ThreatIndicator);\r\n\r\n\r\nInfobloxInsightIndicators\r\n| where InfobloxInsightID == \"{InfobloxInsightID}\"\r\n| where isnotempty(ThreatIndicator)\r\n| where InfobloxB1PolicyAction in ({InfobloxB1PolicyActionParam}) or '{InfobloxB1PolicyActionParam:label}' ==  \"All\"\r\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' ==  \"All\"\r\n| join\r\n    (\r\n        AssetCount\r\n    ) on ThreatIndicator\r\n| summarize arg_max(TimeGenerated, *), count_distinct(SourceMACAddress) by ThreatIndicator, InfobloxB1PolicyAction\r\n| extend URL = strcat(\"https://csp.infoblox.com/#/security_research/search/auto/\", ThreatIndicator, \"/summary\")\r\n| extend sort_order = case(\r\n    ThreatLevel == \"High\", 5,\r\n    ThreatLevel == \"Medium\", 4,\r\n    ThreatLevel == \"Low\", 3,\r\n    ThreatLevel == \"N/A\", 2,\r\n    1 // default case if ThreatLevel doesn't match any of the above\r\n)\r\n| order by sort_order, EventCount desc\r\n| project-away sort_order\r\n| project-rename ['Policy Action'] = InfobloxB1PolicyAction, ['Feed Name'] = InfobloxB1FeedName\r\n| project ThreatIndicator, ['Unique Asset Count'], ['Policy Action'], ThreatLevel, ThreatConfidence, ['Feed Name'], ThreatActor, LastSeen, FirstSeen, EventCount, URL\r\n\r\n",
                     "size": 0,
                     "showAnalytics": true,
                     "timeContextFromParameter": "TimeRange",