From d7791edb8d93c2da6138efe9a93beb08c9cd218d Mon Sep 17 00:00:00 2001
From: Tirthraj Chaudhari
<105789910+tirthrajchaudhari-crest@users.noreply.github.com>
Date: Tue, 8 Oct 2024 21:34:35 +0530
Subject: [PATCH] [SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler
Integration v1.0.0 (#18208)
* Add trend micro vision one xdr assets
* Add images and update readme
* Add integration in labeler.yaml file
* Update pipeline yaml
* Add service in test yaml file
* Update sample in test yaml file
* Update test yaml sample
* Update test results
* Update dashboards
* Minor README change
* Address review comments
* Update manifest file
* Revert app_uuid to it's original value in manifest
* Update display_on_public_website to false in manifest
* Address review comments
* Address review comments
* Remove traliling space in README
* Address review comments
* Update README
* Update readme
---------
Co-authored-by: Thibault Krebs <150821137+thibaultkrebs@users.noreply.github.com>
---
trend_micro_vision_one_xdr/CHANGELOG.md | 2 +-
trend_micro_vision_one_xdr/README.md | 51 +-
...on_one_xdr_observed_attack_techniques.json | 5766 +++++++++++++++++
...micro_vision_one_xdr_workbench_alerts.json | 1696 +++++
.../logs/trend-micro-vision-one-xdr.yaml | 253 +
.../trend-micro-vision-one-xdr_tests.yaml | 1470 +++++
.../assets/trend-micro-vision-one-xdr.svg | 5 +
.../images/trend_micro_vision_one_xdr_oat.png | Bin 0 -> 228420 bytes
..._micro_vision_one_xdr_workbench_alerts.png | Bin 0 -> 411327 bytes
trend_micro_vision_one_xdr/manifest.json | 23 +-
10 files changed, 9241 insertions(+), 25 deletions(-)
create mode 100644 trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_observed_attack_techniques.json
create mode 100644 trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_workbench_alerts.json
create mode 100644 trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr.yaml
create mode 100644 trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr_tests.yaml
create mode 100644 trend_micro_vision_one_xdr/assets/trend-micro-vision-one-xdr.svg
create mode 100644 trend_micro_vision_one_xdr/images/trend_micro_vision_one_xdr_oat.png
create mode 100644 trend_micro_vision_one_xdr/images/trend_micro_vision_one_xdr_workbench_alerts.png
diff --git a/trend_micro_vision_one_xdr/CHANGELOG.md b/trend_micro_vision_one_xdr/CHANGELOG.md
index ad58f16d9618d..ea8d6fcdffd9a 100644
--- a/trend_micro_vision_one_xdr/CHANGELOG.md
+++ b/trend_micro_vision_one_xdr/CHANGELOG.md
@@ -1,6 +1,6 @@
# CHANGELOG - trend-micro-vision-one-xdr
-## 1.0.0 / 2024-08-06
+## 1.0.0 / 2024-08-20
***Added***:
diff --git a/trend_micro_vision_one_xdr/README.md b/trend_micro_vision_one_xdr/README.md
index 9afce7a93e5e0..e6972e006f077 100644
--- a/trend_micro_vision_one_xdr/README.md
+++ b/trend_micro_vision_one_xdr/README.md
@@ -1,43 +1,52 @@
-# Agent Check: trend-micro-vision-one-xdr
-
## Overview
-This check monitors [trend-micro-vision-one-xdr][1].
-
-## Setup
+[Trend Micro Vision One XDR][1] collects and automatically correlates data across multiple security layers: email, endpoint, server, cloud workload, and network. This enables faster threat detection, enhances investigation and response times through improved security analysis.
-### Installation
+This integration ingests the following logs:
-The trend-micro-vision-one-xdr check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+- **Workbench Alerts**: This endpoint contains information about all the standalone alerts triggered by detection models.
+- **Observed Attack Techniques**: This endpoint contains information about observed attack techniques from Detections, Endpoint Activity, Cloud Activity, Email Activity, Mobile Activity, Network Activity, Container Activity, and Identity Activity data sources.
-### Configuration
+This integration collects logs from the sources listed above and sends them to Datadog for analysis with our Log Explorer and Cloud SIEM products
+* [Log Explorer][3]
+* [Cloud SIEM][4]
-!!! Add list of steps to set up this integration !!!
+## Setup
-### Validation
+### Configuration
-!!! Add steps to validate integration is functioning as expected !!!
+1. In the Trend Vision One console, go to on the left side-bar menu and visit **Administration > API Keys** .
+2. Generate a new authentication token. Click **Add API key**. Specify the settings of the new API key with the following:
+ - **Name**: A meaningful name that can help you identify the API key
+ - **Role**: The user role assigned to the key. Select **SIEM** from dropdown.
+ - **Expiration time**: The time the API key remains valid.
+ - **Status**: Whether the API key is enabled.
+ - **Details**: Extra information about the API key.
+3. Click **Add**.
+4. Copy API Key to the form below along with the Host Region of your Trend Micro Vision One XDR console.
## Data Collected
+### Logs
+The Trend Micro Vision One XDR integration collects and forwards Workbench Alerts and Observed Attack Techniques logs to Datadog.
+
### Metrics
-trend-micro-vision-one-xdr does not include any metrics.
+Trend Micro Vision One XDR does not include any metrics.
### Service Checks
-trend-micro-vision-one-xdr does not include any service checks.
+Trend Micro Vision One XDR does not include any service checks.
### Events
-trend-micro-vision-one-xdr does not include any events.
-
-## Troubleshooting
+Trend Micro Vision One XDR does not include any events.
-Need help? Contact [Datadog support][3].
+## Support
-[1]: **LINK_TO_INTEGRATION_SITE**
-[2]: https://app.datadoghq.com/account/settings/agent/latest
-[3]: https://docs.datadoghq.com/help/
+For further assistance, contact [Datadog Support][2].
+[1]: https://www.trendmicro.com/en_in/business/products/detection-response/xdr.html
+[2]: https://docs.datadoghq.com/help/
+[3]: https://docs.datadoghq.com/logs/explorer/
+[4]: https://www.datadoghq.com/product/cloud-siem/
diff --git a/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_observed_attack_techniques.json b/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_observed_attack_techniques.json
new file mode 100644
index 0000000000000..4be225045f8f2
--- /dev/null
+++ b/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_observed_attack_techniques.json
@@ -0,0 +1,5766 @@
+{
+ "title": "Trend Micro Vision One XDR - Observed Attack Techniques",
+ "description": "This dashboard provides the insights into the Observed Attack Techniques detected in Trend Micro Vision One XDR.",
+ "widgets": [
+ {
+ "id": 8859993632667998,
+ "definition": {
+ "title": "New group",
+ "banner_img": "https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/trend-micro-logo.png",
+ "show_title": false,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 5872268233797356,
+ "definition": {
+ "type": "note",
+ "content": "This dashboard offers a comprehensive view of detected attack patterns across various data sources, including network traffic, application logs, and endpoint activities. \n\nThis allows you to visualize and analyze attack techniques in real time, enhancing your ability to identify and respond to threats quickly. \n\nFor more information, see the [Trend Micro Vision One XDR Integration Documentation](https://docs.datadoghq.com/integrations/trend_micro_vision_one_xdr).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.\n",
+ "background_color": "white",
+ "font_size": "14",
+ "text_align": "left",
+ "vertical_align": "top",
+ "show_tick": false,
+ "tick_pos": "50%",
+ "tick_edge": "left",
+ "has_padding": true
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 3
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 6
+ }
+ },
+ {
+ "id": 2505837663829198,
+ "definition": {
+ "title": "OAT Overview",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 6285436885924462,
+ "definition": {
+ "title": "Total OAT Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#dbcbfb"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 5929634824443710,
+ "definition": {
+ "title": "OAT Events by Risk Level over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.filterRiskLevel",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "semantic",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 2,
+ "width": 6,
+ "height": 3
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 6,
+ "y": 0,
+ "width": 6,
+ "height": 6
+ }
+ },
+ {
+ "id": 1371112650735412,
+ "definition": {
+ "title": "OAT Details",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 1439363259599552,
+ "definition": {
+ "title": "Total Critical Risk Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.filterRiskLevel:critical $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#c9080b"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 4,
+ "height": 2
+ }
+ },
+ {
+ "id": 3218088293970404,
+ "definition": {
+ "title": "Total High Risk Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.filterRiskLevel:high $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#edb25a"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 4,
+ "y": 0,
+ "width": 4,
+ "height": 2
+ }
+ },
+ {
+ "id": 3151229309347954,
+ "definition": {
+ "title": "Total Medium Risk Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.filterRiskLevel:medium $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#9baaba"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 8,
+ "y": 0,
+ "width": 4,
+ "height": 2
+ }
+ },
+ {
+ "id": 6866443553302436,
+ "definition": {
+ "title": "Total Low Risk Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.filterRiskLevel:low $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#9acbe3"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 2,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 8174769258761820,
+ "definition": {
+ "title": "Total Info Risk Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.filterRiskLevel:info $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#c4c4c4"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 6,
+ "y": 2,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 6074416801330922,
+ "definition": {
+ "title": "Top 10 Mitre Tactic IDs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@filters.mitreTacticIds",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 4,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1803733434734774,
+ "definition": {
+ "title": "Top Data Sources",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@source",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 4,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2215400544264106,
+ "definition": {
+ "title": "Distribution of Events by Entity Types",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@entityType",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @entityType:* $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "automatic"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 8,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 384677736861298,
+ "definition": {
+ "title": "Top 10 Detection Filters",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@filters.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 8,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 6556763808982186,
+ "definition": {
+ "title": "OAT Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "@source",
+ "width": "auto"
+ },
+ {
+ "field": "detail.filterRiskLevel",
+ "width": "auto"
+ },
+ {
+ "field": "entityType",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 12,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 6,
+ "width": 12,
+ "height": 17
+ }
+ },
+ {
+ "id": 7441664145414468,
+ "definition": {
+ "title": "Endpoint Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 5426472045914522,
+ "definition": {
+ "title": "Total Endpoint Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 1797626759894956,
+ "definition": {
+ "title": "Endpoint Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Endpoint Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 7244503661490156,
+ "definition": {
+ "title": "Top 10 Events by Endpoints Host Name",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.endpointHostName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4873343018560864,
+ "definition": {
+ "title": "Top 10 Events by Endpoint IP Address",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.endpointIp",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2456709559745804,
+ "definition": {
+ "title": "Top 10 Source IP by Source Port",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.client.ip",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ },
+ {
+ "facet": "@network.client.port",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 100,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 5508251173144970,
+ "definition": {
+ "title": "Top 10 Destination IP by Destination Port",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.destination.ip",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ },
+ {
+ "facet": "@network.destination.port",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 100,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1783019166693998,
+ "definition": {
+ "title": "Distribution of Events by Event Type",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@event_type",
+ "limit": 15,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @event_type:* @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "automatic"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7389274854759678,
+ "definition": {
+ "title": "Top Logon Users",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.logonUser",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 11,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 6775716525211552,
+ "definition": {
+ "title": "Endpoint Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:endpointActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "detail.endpointGuid",
+ "width": "auto"
+ },
+ {
+ "field": "detail.endpointHostName",
+ "width": "auto"
+ },
+ {
+ "field": "detail.endpointIp",
+ "width": "auto"
+ },
+ {
+ "field": "detail.endpointHostName",
+ "width": "auto"
+ },
+ {
+ "field": "event_type",
+ "width": "auto"
+ },
+ {
+ "field": "detail.logonUser",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 15,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 23,
+ "width": 12,
+ "height": 20
+ }
+ },
+ {
+ "id": 3382060436808330,
+ "definition": {
+ "title": "Detections",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 7913975426343580,
+ "definition": {
+ "title": "Total Detection Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 7404559020634436,
+ "definition": {
+ "title": "Detection Events over Time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Detection Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 4896234807579516,
+ "definition": {
+ "title": "Top Actions",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.act",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4016760549511546,
+ "definition": {
+ "title": "Top Action Result",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.actResult",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 5800409051189904,
+ "definition": {
+ "title": "Top Blocking Reasons",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.blocking",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7197540351850338,
+ "definition": {
+ "title": "Top Device Hosts",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.dhost",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1724194119716878,
+ "definition": {
+ "title": "Distribution of Events by Protocol Detected",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.app",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.app:* @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2739411107609906,
+ "definition": {
+ "title": "Distribution of Events by Protocol Group Detected",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.appGroup",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.appGroup:* @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 11,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 8566407571327872,
+ "definition": {
+ "title": "Device Directions",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.deviceDirection",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.deviceDirection:* @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 15,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7099911258188320,
+ "definition": {
+ "title": "Product Detection Types",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.detectionType",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.detectionType:* @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 15,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2398974370166006,
+ "definition": {
+ "title": "Top Domain Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.domainName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 19,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 1682560909987186,
+ "definition": {
+ "title": "Top 10 File Detected",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.filePathName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 4,
+ "y": 19,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 7005889840181442,
+ "definition": {
+ "title": "Top Threat Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.threatName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 8,
+ "y": 19,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 4308613118972006,
+ "definition": {
+ "title": "Detection Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:detections $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 23,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 43,
+ "width": 12,
+ "height": 28
+ }
+ },
+ {
+ "id": 7032180084981088,
+ "definition": {
+ "title": "Cloud Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 5833022494538560,
+ "definition": {
+ "title": "Total Cloud Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:cloudActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 4182637362598996,
+ "definition": {
+ "title": "Cloud Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Cloud Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:cloudActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 4
+ }
+ },
+ {
+ "id": 7568428681071846,
+ "definition": {
+ "title": "Total Write Operation Performed",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:cloudActivityData @detail.readOnly:true $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 2,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 8558859139489130,
+ "definition": {
+ "title": "Event Categories",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.eventCategory",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.eventCategory:* @source:cloudActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 4,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 7807773836553110,
+ "definition": {
+ "title": "Top 10 Source IPs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.client.ip",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:cloudActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 4,
+ "y": 4,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 2257606243114956,
+ "definition": {
+ "title": "Event Types",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.eventType",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @detail.eventType:* @source:cloudActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 8,
+ "y": 4,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 1255179917328080,
+ "definition": {
+ "title": "Cloud Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:cloudActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 8,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 71,
+ "width": 12,
+ "height": 13
+ }
+ },
+ {
+ "id": 5225002889620022,
+ "definition": {
+ "title": "Container Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 8682625635013952,
+ "definition": {
+ "title": "Total Container Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 8017593927935330,
+ "definition": {
+ "title": "Container Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Container Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 2326603679404528,
+ "definition": {
+ "title": "Top 10 Container Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.containerName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4289729370071156,
+ "definition": {
+ "title": "Top 10 Cluster Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.clusterName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 6914438569647724,
+ "definition": {
+ "title": "Top 10 Kubernetes Namespace",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.k8sNamespace",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7733735783220814,
+ "definition": {
+ "title": "Top 10 Kubernetes Pod Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.k8sPodName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1216715765591240,
+ "definition": {
+ "title": "Container Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:containerActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 84,
+ "width": 12,
+ "height": 16
+ }
+ },
+ {
+ "id": 5014982733411700,
+ "definition": {
+ "title": "Network Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 6516832094256714,
+ "definition": {
+ "title": "Total Network Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 8306930229862398,
+ "definition": {
+ "title": "Network Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Network Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 4997970225554290,
+ "definition": {
+ "title": "Top 10 Endpoint Host Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.endpointHostName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2841278197342448,
+ "definition": {
+ "title": "Top 10 Requested Destination URL",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.request",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 3434941617984460,
+ "definition": {
+ "title": "Top 10 Endpoint Device OS",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.osName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7216310309513982,
+ "definition": {
+ "title": "Top 10 Source IPs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.client.ip",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 8610890138397744,
+ "definition": {
+ "title": "Server TLS/SSL Versions",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.serverTls",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData @detail.serverTls:* $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 12,
+ "height": 4
+ }
+ },
+ {
+ "id": 2635979354461686,
+ "definition": {
+ "title": "Top 10 Username Domains",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.userDomain",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 15,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 5088776609128686,
+ "definition": {
+ "title": "Top 10 Requested Applications",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.application",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 15,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 96724062506078,
+ "definition": {
+ "title": "Network Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:networkActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 19,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 100,
+ "width": 12,
+ "height": 24
+ }
+ },
+ {
+ "id": 880749577972932,
+ "definition": {
+ "title": "Mobile Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 1623790504315422,
+ "definition": {
+ "title": "Total Mobile Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 8579406685105712,
+ "definition": {
+ "title": "Mobile Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Mobile Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 7519541896726580,
+ "definition": {
+ "title": "Top 10 Endpoint Host Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.endpointHostName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 6429568756216956,
+ "definition": {
+ "title": "Top 10 Endpoint IPs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.endpointIp",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4438383009755712,
+ "definition": {
+ "title": "Top 10 Logon User Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.logonUser",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7798335850604720,
+ "definition": {
+ "title": "Top 10 URL Requested",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.request",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1815967342253956,
+ "definition": {
+ "title": "Mobile Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:mobileActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 124,
+ "width": 12,
+ "height": 16
+ }
+ },
+ {
+ "id": 7920666364535808,
+ "definition": {
+ "title": "Email Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 1852849719266772,
+ "definition": {
+ "title": "Total Email Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 7403349374850776,
+ "definition": {
+ "title": "Email Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Email Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 7587841364240156,
+ "definition": {
+ "title": "Top 10 Email Subjects",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.mailMsgSubject",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 82111249629538,
+ "definition": {
+ "title": "Top 10 Source IPs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.client.ip",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7221221179953388,
+ "definition": {
+ "title": "Top 10 Sender Emails",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.mailFromAddresses",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7496156592161118,
+ "definition": {
+ "title": "Top 10 Recipient Emails",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.mailToAddresses",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 5887080668923920,
+ "definition": {
+ "title": "Distribution of Events by Email Source Domain",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.mailSourceDomain",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData @detail.mailSourceDomain:* $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 12,
+ "height": 4
+ }
+ },
+ {
+ "id": 7155506506563030,
+ "definition": {
+ "title": "Email Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:emailActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 15,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 140,
+ "width": 12,
+ "height": 20
+ }
+ },
+ {
+ "id": 2272283074428766,
+ "definition": {
+ "title": "Identity Activity",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 5244324327154682,
+ "definition": {
+ "title": "Total Identity Activity Events",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 3
+ }
+ },
+ {
+ "id": 8112885728146168,
+ "definition": {
+ "title": "Identity Activity Events over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "alias": "Identity Activity Events",
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "datadog16",
+ "order_by": "values",
+ "color_order": "shuffled",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 9,
+ "height": 3
+ }
+ },
+ {
+ "id": 6172794607423558,
+ "definition": {
+ "title": "Top 10 Users",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@usr.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 7877729730375302,
+ "definition": {
+ "title": "Top Sign-In Status",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.statusReason",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 3,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 12795879177476,
+ "definition": {
+ "title": "Identity Providers",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.idpName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData @detail.idpName:* $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "table"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4137660944974898,
+ "definition": {
+ "title": "Top 10 Identity Provider Event Names",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@detail.eventName",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16",
+ "scaling": "relative"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 7,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 8394399540196262,
+ "definition": {
+ "title": "Identity Event by Region",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "geomap",
+ "requests": [
+ {
+ "response_format": "scalar",
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@network.client.geoip.country.iso_code",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level"
+ },
+ "storage": "hot"
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "palette": "hostmap_blues",
+ "palette_flip": false
+ },
+ "view": {
+ "focus": "WORLD"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 11,
+ "width": 12,
+ "height": 4
+ }
+ },
+ {
+ "id": 5855205773926644,
+ "definition": {
+ "title": "Identity Activity Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:observed-attack-techniques @source:identityActivityData $Source $Risk-Level",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "content",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 15,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 160,
+ "width": 12,
+ "height": 20
+ }
+ },
+ {
+ "id": 2678913500799370,
+ "definition": {
+ "title": "Datadog Cloud SIEM",
+ "title_align": "center",
+ "background_color": "purple",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 8173895520076704,
+ "definition": {
+ "type": "note",
+ "content": "\nDatadog Cloud SIEM analyzes and correlates Observed Attack Techniques logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security). ",
+ "background_color": "purple",
+ "font_size": "14",
+ "text_align": "left",
+ "vertical_align": "center",
+ "show_tick": false,
+ "tick_pos": "50%",
+ "tick_edge": "left",
+ "has_padding": true
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 12,
+ "height": 1
+ }
+ },
+ {
+ "id": 5867027343133690,
+ "definition": {
+ "title": "CRITICALs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#bc303c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:critical $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 1,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 1786303523722774,
+ "definition": {
+ "title": "HIGHs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#d33043",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:high $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2,
+ "timeseries_background": {
+ "type": "area"
+ }
+ },
+ "layout": {
+ "x": 2,
+ "y": 1,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 2577399539515404,
+ "definition": {
+ "title": "Critical Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#bc303c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:critical $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [],
+ "style": {}
+ },
+ "layout": {
+ "x": 4,
+ "y": 1,
+ "width": 8,
+ "height": 4
+ }
+ },
+ {
+ "id": 6209523051868818,
+ "definition": {
+ "title": "MEDIUMs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#e5a21c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:medium $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 8545904237338876,
+ "definition": {
+ "title": "LOWs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#ffb52b",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:low $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 2,
+ "y": 3,
+ "width": 2,
+ "height": 1
+ }
+ },
+ {
+ "id": 1657767111606620,
+ "definition": {
+ "title": "INFOs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#84c1e0",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:info $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 2,
+ "y": 4,
+ "width": 2,
+ "height": 1
+ }
+ },
+ {
+ "id": 8521511668485272,
+ "definition": {
+ "title": "High Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#d33043",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:high $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [
+ {
+ "label": "View related Security Signals",
+ "link": "/security?query=@workflow.rule.name:{{@workflow.rule.name.value}}&column=time&order=desc&view=signal&start={{timestamp_widget_start}}&end={{timestamp_widget_end}}&paused=false"
+ }
+ ],
+ "style": {}
+ },
+ "layout": {
+ "x": 0,
+ "y": 5,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 614168295558700,
+ "definition": {
+ "title": "Medium Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#e5a21c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:observed-attack-techniques status:medium $Source $Risk-Level"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [],
+ "style": {}
+ },
+ "layout": {
+ "x": 6,
+ "y": 5,
+ "width": 6,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 180,
+ "width": 12,
+ "height": 10
+ }
+ }
+ ],
+ "template_variables": [
+ {
+ "name": "Source",
+ "prefix": "@source",
+ "available_values": [],
+ "default": "*"
+ },
+ {
+ "name": "Risk-Level",
+ "prefix": "@detail.filterRiskLevel",
+ "available_values": [],
+ "default": "*"
+ }
+ ],
+ "layout_type": "ordered",
+ "notify_list": [],
+ "reflow_type": "fixed"
+}
\ No newline at end of file
diff --git a/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_workbench_alerts.json b/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_workbench_alerts.json
new file mode 100644
index 0000000000000..d7d2f4c3d07ee
--- /dev/null
+++ b/trend_micro_vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_workbench_alerts.json
@@ -0,0 +1,1696 @@
+{
+ "title": "Trend Micro Vision One XDR - Workbench Alerts",
+ "description": "This dashboard provides the insights into the Alerts generated in Trend Micro Vision One XDR.",
+ "widgets": [
+ {
+ "id": 8442478561211794,
+ "definition": {
+ "title": "New group",
+ "banner_img": "https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/trend-micro-logo.png",
+ "show_title": false,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 661152336132838,
+ "definition": {
+ "type": "note",
+ "content": " Workbench alerts in a Datadog dashboard provide a centralized, real-time alerts generated in Trend Micro Vision One XDR. These alerts aggregate and offering insights into security incidents. \n\nThis holistic approach enhances visibility, improves incident response times, and supports proactive system management, ensuring robust and reliable application performance.\n\nFor more information, see the [Trend Micro Vision One XDR Integration Documentation](https://docs.datadoghq.com/integrations/trend_micro_vision_one_xdr).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.",
+ "background_color": "white",
+ "font_size": "14",
+ "text_align": "left",
+ "vertical_align": "top",
+ "show_tick": false,
+ "tick_pos": "50%",
+ "tick_edge": "left",
+ "has_padding": true
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 3
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 6
+ }
+ },
+ {
+ "id": 395271531831574,
+ "definition": {
+ "title": "Workbench Alerts Overview",
+ "background_color": "pink",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 6285436885924462,
+ "definition": {
+ "title": "Total Alerts",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#f4bebe"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 1764028348108714,
+ "definition": {
+ "title": "Alerts by Severity over time",
+ "title_size": "16",
+ "title_align": "left",
+ "show_legend": true,
+ "legend_layout": "auto",
+ "legend_columns": [
+ "avg",
+ "min",
+ "max",
+ "value",
+ "sum"
+ ],
+ "type": "timeseries",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id",
+ "interval": 600000
+ },
+ "group_by": [
+ {
+ "facet": "@severity",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "timeseries",
+ "style": {
+ "palette": "dog_classic",
+ "order_by": "values",
+ "line_type": "solid",
+ "line_width": "normal"
+ },
+ "display_type": "line"
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 2,
+ "width": 6,
+ "height": 3
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 6,
+ "y": 0,
+ "width": 6,
+ "height": 6
+ }
+ },
+ {
+ "id": 5161758451345736,
+ "definition": {
+ "title": "Workbench Alerts",
+ "background_color": "pink",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 7756629473135054,
+ "definition": {
+ "title": "Total Alerts with Critical Severity",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @severity:critical $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#c9080b"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 2142172297914268,
+ "definition": {
+ "title": "Total Alerts with High Severity",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @severity:high $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#edb25a"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 3,
+ "y": 0,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 7145178723253610,
+ "definition": {
+ "title": "Total Alerts with Medium Severity",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @severity:medium $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#9baaba"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 6,
+ "y": 0,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 5555186778783376,
+ "definition": {
+ "title": "Total Alerts with Low Severity",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @severity:low $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#9acbe3"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 9,
+ "y": 0,
+ "width": 3,
+ "height": 2
+ }
+ },
+ {
+ "id": 6092838927988990,
+ "definition": {
+ "title": "Total Incidents",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@incidentId"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#f3f1af"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 2,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 1751665977588806,
+ "definition": {
+ "title": "Avg. Impact Score",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "avg",
+ "metric": "@trend_micro_vision_one_xdr.score"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "conditional_formats": [
+ {
+ "comparator": ">=",
+ "value": 0,
+ "palette": "custom_bg",
+ "custom_bg_color": "#96edb5"
+ }
+ ]
+ }
+ ],
+ "autoscale": true,
+ "precision": 2
+ },
+ "layout": {
+ "x": 6,
+ "y": 2,
+ "width": 6,
+ "height": 2
+ }
+ },
+ {
+ "id": 4313997968959812,
+ "definition": {
+ "title": "Alerts by Status",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@status",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @status:* $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "automatic"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 4,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 1221237570406462,
+ "definition": {
+ "title": "Top 5 Alerts Findings",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@investigationResult",
+ "limit": 5,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 5,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 4,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 2287855955637190,
+ "definition": {
+ "title": "Detection Model Types",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@modelType",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @modelType:* $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "legend": {
+ "type": "automatic"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 8,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 5034898244239830,
+ "definition": {
+ "title": "Top Alerts by Detection Model",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@model",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 6,
+ "y": 8,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 4860186400202994,
+ "definition": {
+ "title": "Impact Scope Entity Types",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@impactScope.entities.entityType",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts @impactScope.entities.entityType:* $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 500,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "style": {
+ "palette": "datadog16"
+ }
+ }
+ ],
+ "type": "sunburst",
+ "hide_total": true,
+ "legend": {
+ "type": "automatic"
+ }
+ },
+ "layout": {
+ "x": 0,
+ "y": 12,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 6074416801330922,
+ "definition": {
+ "title": "Top 10 Mitre Technique IDs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@matchedRules.matchedFilters.mitreTechniqueIds",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 4,
+ "y": 12,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 8237383137715168,
+ "definition": {
+ "title": "Top 10 Alerts Indicator Types",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "toplist",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "cardinality",
+ "metric": "@id"
+ },
+ "group_by": [
+ {
+ "facet": "@indicators.type",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "cardinality",
+ "metric": "@id"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "style": {
+ "display": {
+ "type": "stacked",
+ "legend": "automatic"
+ },
+ "palette": "datadog16"
+ }
+ },
+ "layout": {
+ "x": 8,
+ "y": 12,
+ "width": 4,
+ "height": 4
+ }
+ },
+ {
+ "id": 1121825025831222,
+ "definition": {
+ "title": "Top Alerts with High Impact Score",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_table",
+ "requests": [
+ {
+ "queries": [
+ {
+ "data_source": "logs",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "avg",
+ "metric": "@trend_micro_vision_one_xdr.score"
+ },
+ "group_by": [
+ {
+ "facet": "@id",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "avg",
+ "metric": "@trend_micro_vision_one_xdr.score"
+ }
+ },
+ {
+ "facet": "@workbenchLink",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "avg",
+ "metric": "@trend_micro_vision_one_xdr.score"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID"
+ },
+ "storage": "hot"
+ }
+ ],
+ "response_format": "scalar",
+ "sort": {
+ "count": 100,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ },
+ "formulas": [
+ {
+ "cell_display_mode": "bar",
+ "alias": "Impact Score",
+ "formula": "query1"
+ }
+ ]
+ }
+ ],
+ "has_search_bar": "auto",
+ "custom_links": [
+ {
+ "label": "Trend Micro Workbench Alert",
+ "link": "{{@workbenchLink.value}}"
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 16,
+ "width": 12,
+ "height": 4
+ }
+ },
+ {
+ "id": 6556763808982186,
+ "definition": {
+ "title": "Workbench Alert Details",
+ "title_size": "16",
+ "title_align": "left",
+ "requests": [
+ {
+ "response_format": "event_list",
+ "query": {
+ "data_source": "logs_stream",
+ "query_string": "source:trend-micro-vision-one-xdr service:alerts $Status $Incident-ID $Entity-Type $Alert-ID",
+ "indexes": [],
+ "storage": "hot"
+ },
+ "columns": [
+ {
+ "field": "status_line",
+ "width": "auto"
+ },
+ {
+ "field": "timestamp",
+ "width": "auto"
+ },
+ {
+ "field": "severity",
+ "width": "auto"
+ },
+ {
+ "field": "@trend_micro_vision_one_xdr.score",
+ "width": "auto"
+ },
+ {
+ "field": "incidentId",
+ "width": "auto"
+ },
+ {
+ "field": "@status",
+ "width": "auto"
+ },
+ {
+ "field": "investigationResult",
+ "width": "auto"
+ },
+ {
+ "field": "modelType",
+ "width": "auto"
+ },
+ {
+ "field": "model",
+ "width": "auto"
+ },
+ {
+ "field": "message",
+ "width": "auto"
+ }
+ ]
+ }
+ ],
+ "type": "list_stream"
+ },
+ "layout": {
+ "x": 0,
+ "y": 20,
+ "width": 12,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 6,
+ "width": 12,
+ "height": 25,
+ "is_column_break": true
+ }
+ },
+ {
+ "id": 8315892998152908,
+ "definition": {
+ "title": "Datadog Cloud SIEM",
+ "title_align": "center",
+ "background_color": "pink",
+ "show_title": true,
+ "type": "group",
+ "layout_type": "ordered",
+ "widgets": [
+ {
+ "id": 6111481529370340,
+ "definition": {
+ "type": "note",
+ "content": "\nDatadog Cloud SIEM analyzes and correlates Workbench Alert logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security). ",
+ "background_color": "pink",
+ "font_size": "14",
+ "text_align": "left",
+ "vertical_align": "center",
+ "show_tick": false,
+ "tick_pos": "50%",
+ "tick_edge": "left",
+ "has_padding": true
+ },
+ "layout": {
+ "x": 0,
+ "y": 0,
+ "width": 12,
+ "height": 1
+ }
+ },
+ {
+ "id": 3615505781531662,
+ "definition": {
+ "title": "CRITICALs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#bc303c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:critical $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 1,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 4221628299028734,
+ "definition": {
+ "title": "HIGHs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#d33043",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:high $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2,
+ "timeseries_background": {
+ "type": "area"
+ }
+ },
+ "layout": {
+ "x": 2,
+ "y": 1,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 6037760580850864,
+ "definition": {
+ "title": "Critical Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#bc303c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:critical $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [],
+ "style": {}
+ },
+ "layout": {
+ "x": 4,
+ "y": 1,
+ "width": 8,
+ "height": 4
+ }
+ },
+ {
+ "id": 2765011665025946,
+ "definition": {
+ "title": "MEDIUMs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#e5a21c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:medium $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 0,
+ "y": 3,
+ "width": 2,
+ "height": 2
+ }
+ },
+ {
+ "id": 5098768218681716,
+ "definition": {
+ "title": "LOWs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#ffb52b",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:low $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 2,
+ "y": 3,
+ "width": 2,
+ "height": 1
+ }
+ },
+ {
+ "id": 5366845962825944,
+ "definition": {
+ "title": "INFOs",
+ "title_size": "16",
+ "title_align": "left",
+ "type": "query_value",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#84c1e0",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:info $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar"
+ }
+ ],
+ "autoscale": true,
+ "custom_links": [],
+ "precision": 2
+ },
+ "layout": {
+ "x": 2,
+ "y": 4,
+ "width": 2,
+ "height": 1
+ }
+ },
+ {
+ "id": 1594813636767484,
+ "definition": {
+ "title": "High Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#d33043",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:high $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [],
+ "style": {}
+ },
+ "layout": {
+ "x": 0,
+ "y": 5,
+ "width": 6,
+ "height": 4
+ }
+ },
+ {
+ "id": 3461316408988100,
+ "definition": {
+ "title": "Medium Security Signals",
+ "type": "toplist",
+ "requests": [
+ {
+ "conditional_formats": [
+ {
+ "comparator": ">",
+ "custom_bg_color": "#e5a21c",
+ "palette": "custom_bg",
+ "value": 0
+ }
+ ],
+ "queries": [
+ {
+ "data_source": "security_signals",
+ "name": "query1",
+ "indexes": [
+ "*"
+ ],
+ "compute": {
+ "aggregation": "count"
+ },
+ "group_by": [
+ {
+ "facet": "@workflow.rule.name",
+ "limit": 10,
+ "sort": {
+ "order": "desc",
+ "aggregation": "count"
+ }
+ }
+ ],
+ "search": {
+ "query": "source:trend-micro-vision-one-xdr service:alerts status:medium $Alert-ID $Status $Incident-ID $Entity-Type"
+ }
+ }
+ ],
+ "response_format": "scalar",
+ "formulas": [
+ {
+ "formula": "query1"
+ }
+ ],
+ "sort": {
+ "count": 10,
+ "order_by": [
+ {
+ "type": "formula",
+ "index": 0,
+ "order": "desc"
+ }
+ ]
+ }
+ }
+ ],
+ "custom_links": [],
+ "style": {}
+ },
+ "layout": {
+ "x": 6,
+ "y": 5,
+ "width": 6,
+ "height": 4
+ }
+ }
+ ]
+ },
+ "layout": {
+ "x": 0,
+ "y": 31,
+ "width": 12,
+ "height": 10
+ }
+ }
+ ],
+ "template_variables": [
+ {
+ "name": "Alert-ID",
+ "prefix": "@id",
+ "available_values": [],
+ "default": "*"
+ },
+ {
+ "name": "Status",
+ "prefix": "@status",
+ "available_values": [],
+ "default": "*"
+ },
+ {
+ "name": "Incident-ID",
+ "prefix": "@incidentId",
+ "available_values": [],
+ "default": "*"
+ },
+ {
+ "name": "Entity-Type",
+ "prefix": "@impactScope.entities.entityType",
+ "available_values": [],
+ "default": "*"
+ }
+ ],
+ "layout_type": "ordered",
+ "notify_list": [],
+ "reflow_type": "fixed"
+}
\ No newline at end of file
diff --git a/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr.yaml b/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr.yaml
new file mode 100644
index 0000000000000..b50e8eb0df708
--- /dev/null
+++ b/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr.yaml
@@ -0,0 +1,253 @@
+id: trend-micro-vision-one-xdr
+metric_id: trend-micro-vision-one-xdr
+backend_only: false
+facets:
+ - groups:
+ - Geoip
+ name: City Name
+ path: network.client.geoip.city.name
+ source: log
+ - groups:
+ - Geoip
+ name: Continent Code
+ path: network.client.geoip.continent.code
+ source: log
+ - groups:
+ - Geoip
+ name: Continent Name
+ path: network.client.geoip.continent.name
+ source: log
+ - groups:
+ - Geoip
+ name: Country ISO Code
+ path: network.client.geoip.country.iso_code
+ source: log
+ - groups:
+ - Geoip
+ name: Country Name
+ path: network.client.geoip.country.name
+ source: log
+ - groups:
+ - Geoip
+ name: Subdivision ISO Code
+ path: network.client.geoip.subdivision.iso_code
+ source: log
+ - groups:
+ - Geoip
+ name: Subdivision Name
+ path: network.client.geoip.subdivision.name
+ source: log
+ - groups:
+ - Web Access
+ name: Client IP
+ path: network.client.ip
+ source: log
+ - groups:
+ - Web Access
+ name: Client Port
+ path: network.client.port
+ source: log
+ - groups:
+ - Web Access
+ name: Destination IP
+ path: network.destination.ip
+ source: log
+ - groups:
+ - Web Access
+ name: Destination Port
+ path: network.destination.port
+ source: log
+ - groups:
+ - User
+ name: User Email
+ path: usr.email
+ source: log
+ - groups:
+ - User
+ name: User ID
+ path: usr.id
+ source: log
+ - groups:
+ - User
+ name: User Name
+ path: usr.name
+ source: log
+ - facetType: range
+ groups:
+ - Trend Micro Vision One XDR
+ name: Impact Score
+ path: trend_micro_vision_one_xdr.score
+ source: log
+ type: double
+pipeline:
+ type: pipeline
+ name: Trend Micro Vision One XDR
+ enabled: true
+ filter:
+ query: "source:trend-micro-vision-one-xdr"
+ processors:
+ - type: date-remapper
+ name: "Define `updatedDateTime`, `detectedDateTime` as the official date of the log"
+ enabled: true
+ sources:
+ - updatedDateTime
+ - detectedDateTime
+ - type: pipeline
+ name: Alerts
+ enabled: true
+ filter:
+ query: "service:alerts "
+ processors:
+ - type: attribute-remapper
+ name: Map `score` to `trend_micro_vision_one_xdr.score`
+ enabled: true
+ sources:
+ - score
+ sourceType: attribute
+ target: trend_micro_vision_one_xdr.score
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - name: Lookup on `severity` to `alert_severity` Field
+ enabled: true
+ source: severity
+ target: alert_severity
+ lookupTable: |-
+ critical,Critical
+ high,Warning
+ medium,Notice
+ low,Info
+ type: lookup-processor
+ - type: status-remapper
+ name: Define `alert_severity` as the official status of the log
+ enabled: true
+ sources:
+ - alert_severity
+ - type: message-remapper
+ name: Define `description` as the official message of the log
+ enabled: true
+ sources:
+ - description
+ - type: pipeline
+ name: Observed Attack Techniques
+ enabled: true
+ filter:
+ query: "service:observed-attack-techniques"
+ processors:
+ - type: attribute-remapper
+ name: Map `detail.userDisplayName` to `usr.name`
+ enabled: true
+ sources:
+ - detail.userDisplayName
+ sourceType: attribute
+ target: usr.name
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.userId` to `usr.id`
+ enabled: true
+ sources:
+ - detail.userId
+ sourceType: attribute
+ target: usr.id
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.src`, `detail.sourceIPAddress`, `detail.mailSenderIp`,
+ `detail.ipAddress` to `network.client.ip`
+ enabled: true
+ sources:
+ - detail.src
+ - detail.sourceIPAddress
+ - detail.mailSenderIp
+ - detail.ipAddress
+ sourceType: attribute
+ target: network.client.ip
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.spt` to `network.client.port`
+ enabled: true
+ sources:
+ - detail.spt
+ sourceType: attribute
+ target: network.client.port
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.dst` to `network.destination.ip`
+ enabled: true
+ sources:
+ - detail.dst
+ sourceType: attribute
+ target: network.destination.ip
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.dpt` to `network.destination.port`
+ enabled: true
+ sources:
+ - detail.dpt
+ sourceType: attribute
+ target: network.destination.port
+ targetType: attribute
+ preserveSource: false
+ overrideOnConflict: false
+ - type: attribute-remapper
+ name: Map `detail.mailToAddresses` to `usr.email`
+ enabled: true
+ sources:
+ - detail.mailToAddresses
+ sourceType: attribute
+ target: usr.email
+ targetType: attribute
+ preserveSource: true
+ overrideOnConflict: false
+ - type: geo-ip-parser
+ name: Extracting geolocation information from the client IP
+ enabled: true
+ sources:
+ - network.client.ip
+ target: network.client.geoip
+ ip_processing_behavior: do-nothing
+ - name: Lookup on `detail.filterRiskLevel` to `oat_event_severity` Field
+ enabled: true
+ source: detail.filterRiskLevel
+ target: oat_event_severity
+ lookupTable: |-
+ critical,Critical
+ high,Warning
+ medium,Notice
+ low,Info
+ info,Debug
+ type: lookup-processor
+ - name: Lookup on `detail.eventId` to `event_type`
+ enabled: true
+ source: detail.eventId
+ target: event_type
+ lookupTable: |-
+ 1,EVENT_PROCESS
+ 2,EVENT_FILE
+ 3,EVENT_CONNECTIO
+ 4,EVENT_DNS
+ 5,EVENT_REGISTRY
+ 6,EVENT_ACCOUNT
+ 7,EVENT_INTERNET
+ 8,XDR_EVENT_MODIFIED_PROCESS
+ 9,EVENT_WINDOWS_HOOK
+ 10,EVENT_WINDOWS_EVENT
+ 11,EVENT_AMSI
+ 12,EVENT_WMI
+ 13,TELEMETRY_MEMORY
+ 14,TELEMETRY_BM
+ type: lookup-processor
+ - type: status-remapper
+ name: Define `oat_event_severity` as the official status of the log
+ enabled: true
+ sources:
+ - oat_event_severity
diff --git a/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr_tests.yaml b/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr_tests.yaml
new file mode 100644
index 0000000000000..75d17733ca5da
--- /dev/null
+++ b/trend_micro_vision_one_xdr/assets/logs/trend-micro-vision-one-xdr_tests.yaml
@@ -0,0 +1,1470 @@
+id: trend-micro-vision-one-xdr
+tests:
+ -
+ sample: |-
+ {
+ "investigationStatus" : "New",
+ "severity" : "low",
+ "schemaVersion" : "1.15",
+ "matchedRules" : [ {
+ "name" : "Predictive Machine Learning Detection - Blocked",
+ "id" : "b52ebb2a-b7b0-4521-b0c9-1a04715c9871",
+ "matchedFilters" : [ {
+ "matchedDateTime" : "2024-07-30T06:24:52.000Z",
+ "name" : "Predictive Machine Learning Detection - Blocked",
+ "id" : "15d9a461-14c4-444b-9d17-7b258894b816",
+ "matchedEvents" : [ {
+ "matchedDateTime" : "2024-07-30T06:24:52.000Z",
+ "type" : "PRODUCT_EVENT_LOG",
+ "uuid" : "966495ba-1cde-491b-a62c-fd62f4ebb80b"
+ } ]
+ } ]
+ } ],
+ "workbenchLink" : "https://portal.in.xdr.trendmicro.com/index.html#/workbench/alerts/WB-12773-20240730-00015",
+ "modelId" : "5727ebf9-9e6a-47f3-b27f-4129763f7688",
+ "createdDateTime" : "2024-07-30T07:18:33Z",
+ "description" : "An unknown threat was detected on an endpoint and blocked by Trend Micro Predictive Machine Learning.",
+ "investigationResult" : "No Findings",
+ "alertProvider" : "SAE",
+ "modelType" : "preset",
+ "indicators" : [ {
+ "provenance" : [ "Alert" ],
+ "field" : "detectionName",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 1,
+ "type" : "detection_name",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "TROJ.Win32.TRX.XXPE50FLM011"
+ }, {
+ "provenance" : [ "Alert" ],
+ "field" : "fileHash",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 2,
+ "type" : "file_sha1",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "609A2BB1984FF9DBBFDBC8A88E1A57FC7691E6E6"
+ }, {
+ "provenance" : [ "Alert" ],
+ "field" : "fileName",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 3,
+ "type" : "filename",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "inv.exe"
+ }, {
+ "provenance" : [ "Alert" ],
+ "field" : "fullPath",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 4,
+ "type" : "fullpath",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "full\\path"
+ }, {
+ "provenance" : [ "Alert" ],
+ "field" : "actResult",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 5,
+ "type" : "text",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "Quarantine successfully"
+ }, {
+ "provenance" : [ "Alert" ],
+ "field" : "processUser",
+ "filterIds" : [ "15d9a461-14c4-444b-9d17-7b258894b816" ],
+ "id" : 6,
+ "type" : "user_account",
+ "relatedEntities" : [ "B159820E-5BB3-49F2-AD98-75A4F2052282" ],
+ "value" : "Crest"
+ } ],
+ "updatedDateTime" : "2024-07-30T07:18:38Z",
+ "score" : 20,
+ "model" : "Unknown Threat Detection and Mitigation via Predictive Machine Learning",
+ "id" : "WB-12773-20240730-00015",
+ "incidentId" : "IC-12773-20240730-00000",
+ "impactScope" : {
+ "serverCount" : 0,
+ "accountCount" : 0,
+ "desktopCount" : 1,
+ "entities" : [ {
+ "entityValue" : {
+ "name" : "assettag-eid",
+ "guid" : "B159820E-5BB3-49F2-AD98-75A4F2046547",
+ "ips" : [ "10.10.10.10" ]
+ },
+ "provenance" : [ "Alert" ],
+ "managementScopeGroupId" : "de4f892d-d1ed-450f-a8c1-4d838768f054",
+ "entityType" : "host",
+ "entityId" : "B159820E-5BB3-49F2-AD98-75A4F2046547",
+ "relatedIndicatorIds" : [ 1, 2, 3, 4, 5, 6 ]
+ } ],
+ "emailAddressCount" : 0,
+ "cloudIdentityCount" : 0,
+ "containerCount" : 0
+ },
+ "status" : "Open"
+ }
+ service: "alerts"
+ result:
+ custom:
+ alertProvider: "SAE"
+ alert_severity: "Info"
+ createdDateTime: "2024-07-30T07:18:33Z"
+ id: "WB-12773-20240730-00015"
+ impactScope:
+ accountCount: 0
+ cloudIdentityCount: 0
+ containerCount: 0
+ desktopCount: 1
+ emailAddressCount: 0
+ entities:
+ -
+ entityValue:
+ name: "assettag-eid"
+ guid: "B159820E-5BB3-49F2-AD98-75A4F2046547"
+ ips:
+ - "10.10.10.10"
+ provenance:
+ - "Alert"
+ managementScopeGroupId: "de4f892d-d1ed-450f-a8c1-4d838768f054"
+ entityType: "host"
+ entityId: "B159820E-5BB3-49F2-AD98-75A4F2046547"
+ relatedIndicatorIds:
+ - 1
+ - 2
+ - 3
+ - 4
+ - 5
+ - 6
+ serverCount: 0
+ incidentId: "IC-12773-20240730-00000"
+ indicators:
+ -
+ provenance:
+ - "Alert"
+ field: "detectionName"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 1
+ type: "detection_name"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "TROJ.Win32.TRX.XXPE50FLM011"
+ -
+ provenance:
+ - "Alert"
+ field: "fileHash"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 2
+ type: "file_sha1"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "609A2BB1984FF9DBBFDBC8A88E1A57FC7691E6E6"
+ -
+ provenance:
+ - "Alert"
+ field: "fileName"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 3
+ type: "filename"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "inv.exe"
+ -
+ provenance:
+ - "Alert"
+ field: "fullPath"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 4
+ type: "fullpath"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "full\\path"
+ -
+ provenance:
+ - "Alert"
+ field: "actResult"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 5
+ type: "text"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "Quarantine successfully"
+ -
+ provenance:
+ - "Alert"
+ field: "processUser"
+ filterIds:
+ - "15d9a461-14c4-444b-9d17-7b258894b816"
+ id: 6
+ type: "user_account"
+ relatedEntities:
+ - "B159820E-5BB3-49F2-AD98-75A4F2052282"
+ value: "Crest"
+ investigationResult: "No Findings"
+ investigationStatus: "New"
+ matchedRules:
+ -
+ name: "Predictive Machine Learning Detection - Blocked"
+ id: "b52ebb2a-b7b0-4521-b0c9-1a04715c9871"
+ matchedFilters:
+ -
+ matchedDateTime: "2024-07-30T06:24:52.000Z"
+ name: "Predictive Machine Learning Detection - Blocked"
+ id: "15d9a461-14c4-444b-9d17-7b258894b816"
+ matchedEvents:
+ -
+ matchedDateTime: "2024-07-30T06:24:52.000Z"
+ type: "PRODUCT_EVENT_LOG"
+ uuid: "966495ba-1cde-491b-a62c-fd62f4ebb80b"
+ model: "Unknown Threat Detection and Mitigation via Predictive Machine Learning"
+ modelId: "5727ebf9-9e6a-47f3-b27f-4129763f7688"
+ modelType: "preset"
+ schemaVersion: "1.15"
+ severity: "low"
+ status: "Open"
+ trend_micro_vision_one_xdr:
+ score: 20
+ updatedDateTime: "2024-07-30T07:18:38Z"
+ workbenchLink: "https://portal.in.xdr.trendmicro.com/index.html#/workbench/alerts/WB-12773-20240730-00015"
+ message: "An unknown threat was detected on an endpoint and blocked by Trend Micro Predictive Machine Learning."
+ service: "alerts"
+ status: "info"
+ tags:
+ - "source:LOGS_SOURCE"
+ timestamp: 1722323918000
+ -
+ sample: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "801b7e5f-902e-4ebd-ad6a-c8f431fe6053",
+ "endpointName" : "DESKTOP-N19I543",
+ "ips" : [ "ab80::42jk:a793:2667:b585", "10.10.10.10" ]
+ },
+ "detectedDateTime" : "2024-07-30T16:20:25Z",
+ "entityType" : "endpoint",
+ "entityName" : "DESKTOP-N19I543(ab80::42jk:a793:2667:b585,10.10.10.10)",
+ "source" : "endpointActivityData",
+ "filters" : [ {
+ "riskLevel" : "low",
+ "mitreTacticIds" : [ "TA0002", "TA0003", "TA0004" ],
+ "mitreTechniqueIds" : [ "T1053", "T1053.005" ],
+ "name" : "Creation of Scheduled Task",
+ "description" : "A scheduled task was created via command-line",
+ "id" : "F1507",
+ "highlightedObjects" : [ {
+ "field" : "objectCmd",
+ "type" : "command_line",
+ "value" : "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F"
+ }, {
+ "field" : "processCmd",
+ "type" : "command_line",
+ "value" : "system32\\msiexec.exe /V"
+ } ],
+ "type" : "preset"
+ } ],
+ "detail" : {
+ "processFileHashSha256" : "d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb",
+ "processUserDomain" : "NT AUTHORITY",
+ "eventSubId" : 2,
+ "plang" : 1,
+ "pver" : "1.2.0.5259",
+ "objectSignerFlagsRuntime" : [ false ],
+ "processSignerFlagsLibValid" : [ false ],
+ "objectTrueType" : 7,
+ "processFileSize" : "69632",
+ "endpointHostName" : "DESKTOP-N19I543",
+ "objectSessionId" : "0",
+ "parentFilePath" : "System32\\services.exe",
+ "processLaunchTime" : "1722356422814",
+ "objectHashId" : "148323463451116793",
+ "eventSourceType" : 1,
+ "objectIntegrityLevel" : 16384,
+ "objectRunAsLocalAccount" : false,
+ "tags" : [ "MITRE.T1053.005", "XSAE.F1507", "MITRE.T1053" ],
+ "parentName" : "System32\\services.exe",
+ "lastSeen" : "1722356425050",
+ "parentSignerFlagsLibValid" : [ false ],
+ "objectUser" : "SYSTEM",
+ "objectFileCreation" : "1722282120740",
+ "osDescription" : "Windows 10 Pro (64 bit) build 19045",
+ "objectCmd" : "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F",
+ "osVer" : "10.0.19045",
+ "processSigner" : [ "Microsoft Windows" ],
+ "parentCmd" : "system32\\services.exe",
+ "endpointMacAddress" : [ "00:0d:30:e4:8b:b6" ],
+ "parentFileCreation" : "1722281953380",
+ "processFileHashMd5" : "78912ea8790de51d2c7ceb9b8c572346",
+ "processCmd" : "system32\\msiexec.exe /V",
+ "processUserGroupSids" : [ "S-1-16-16384", "S-1-1-0", "S-1-5-32-545", "S-1-5-6", "S-1-2-1", "S-1-5-11", "S-1-5-15", "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966", "S-1-5-5-0-36366980", "S-1-2-0", "S-1-5-32-544" ],
+ "parentSessionId" : 0,
+ "parentFileHashId" : "-4092577940452904134",
+ "sessionId" : 0,
+ "processFilePath" : "System32\\msiexec.exe",
+ "osName" : "Windows",
+ "productCode" : "xes",
+ "parentFileHashSha256" : "1efd9a81b2ddf21b3f327d67a6f8f88f814979e84085ec812af72450310d4281",
+ "processFileHashSha1" : "6a795b8a432514f20ff884f1a5286ea82e32e150",
+ "processTrueType" : 7,
+ "objectFileHashId" : "-370955917314104624",
+ "objectFileSize" : "187904",
+ "parentHashId" : "-5897584668177803063",
+ "parentSignerValid" : [ true ],
+ "uuid" : "65f9d8c7-33a9-41a3-a1a6-445376599211",
+ "parentUserDomain" : "NT AUTHORITY",
+ "eventHashId" : "-8250022594686035748",
+ "processSignerValid" : [ true ],
+ "parentFileModifiedTime" : "1722281953458",
+ "objectFileHashSha256" : "29f6fc1bb0e68cb4fc1ec597604ec5aca7fcef7d0d9241218596d941f04f16e7",
+ "processName" : "System32\\msiexec.exe",
+ "parentSignerFlagsAdhoc" : [ false ],
+ "parentAuthId" : "999",
+ "objectFileHashMd5" : "db6f48dc66879299b49ee3f1df0607f1",
+ "filterRiskLevel" : "low",
+ "eventId" : "1",
+ "firstSeen" : "1722356425050",
+ "objectFilePath" : "SysWOW64\\schtasks.exe",
+ "pname" : "751",
+ "parentLaunchTime" : "1722285790679",
+ "parentFileHashMd5" : "4eacbe64bb1e7d58e8a26340ed1c7cbd",
+ "processSignerFlagsAdhoc" : [ false ],
+ "objectSigner" : [ "Microsoft Windows" ],
+ "processPid" : 408,
+ "parentSigner" : [ "Microsoft Windows Publisher" ],
+ "objectSignerFlagsLibValid" : [ false ],
+ "integrityLevel" : 16384,
+ "processFileModifiedTime" : "1722282337774",
+ "objectFileHashSha1" : "5673be4c0b3d6c963651ec1e4adb7aaabadf5a19",
+ "pplat" : 5889,
+ "parentSignerFlagsRuntime" : [ false ],
+ "parentIntegrityLevel" : 16384,
+ "processSignerFlagsRuntime" : [ false ],
+ "objectLaunchTime" : "1722356425049",
+ "objectUserGroupSids" : [ "S-1-16-16384", "S-1-1-0", "S-1-5-32-545", "S-1-5-6", "S-1-2-1", "S-1-5-11", "S-1-5-15", "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966", "S-1-5-5-0-36366980", "S-1-2-0", "S-1-5-32-544" ],
+ "timezone" : "UTC+05:30",
+ "processUser" : "SYSTEM",
+ "logReceivedTime" : "1722356504612",
+ "objectSignerFlagsAdhoc" : [ false ],
+ "authId" : "999",
+ "osType" : "0x00000030",
+ "processFileCreation" : "1722282337759",
+ "objectUserDomain" : "NT AUTHORITY",
+ "processHashId" : "7052107378290747991",
+ "parentPid" : 688,
+ "endpointIp" : [ "ab80::42jk:a793:2667:b585", "10.10.10.10" ],
+ "objectSignerValid" : [ true ],
+ "parentTrueType" : 7,
+ "parentFileSize" : "716544",
+ "parentFileHashSha1" : "6703d48349de8c836c0eaffac5cfac7679da7f60",
+ "objectAuthId" : "999",
+ "endpointGuid" : "801b7e5f-902e-4ebd-ad6a-c8f431fe6053",
+ "objectName" : "SysWOW64\\schtasks.exe",
+ "processFileHashId" : "-5659244633155638992",
+ "objectPid" : 6292,
+ "parentUser" : "SYSTEM",
+ "objectFileModifiedTime" : "1722282120756"
+ },
+ "ingestedDateTime" : "2024-07-30T16:22:16Z",
+ "uuid" : "65f9d8c7-33a9-41a3-a1a6-445376599211"
+ }
+ service: "observed-attack-techniques"
+ result:
+ custom:
+ detail:
+ authId: "999"
+ endpointGuid: "801b7e5f-902e-4ebd-ad6a-c8f431fe6053"
+ endpointHostName: "DESKTOP-N19I543"
+ endpointIp:
+ - "ab80::42jk:a793:2667:b585"
+ - "10.10.10.10"
+ endpointMacAddress:
+ - "00:0d:30:e4:8b:b6"
+ eventHashId: "-8250022594686035748"
+ eventId: "1"
+ eventSourceType: 1
+ eventSubId: 2
+ filterRiskLevel: "low"
+ firstSeen: "1722356425050"
+ integrityLevel: 16384
+ lastSeen: "1722356425050"
+ logReceivedTime: "1722356504612"
+ objectAuthId: "999"
+ objectCmd: "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F"
+ objectFileCreation: "1722282120740"
+ objectFileHashId: "-370955917314104624"
+ objectFileHashMd5: "db6f48dc66879299b49ee3f1df0607f1"
+ objectFileHashSha1: "5673be4c0b3d6c963651ec1e4adb7aaabadf5a19"
+ objectFileHashSha256: "29f6fc1bb0e68cb4fc1ec597604ec5aca7fcef7d0d9241218596d941f04f16e7"
+ objectFileModifiedTime: "1722282120756"
+ objectFilePath: "SysWOW64\\schtasks.exe"
+ objectFileSize: "187904"
+ objectHashId: "148323463451116793"
+ objectIntegrityLevel: 16384
+ objectLaunchTime: "1722356425049"
+ objectName: "SysWOW64\\schtasks.exe"
+ objectPid: 6292
+ objectRunAsLocalAccount: false
+ objectSessionId: "0"
+ objectSigner:
+ - "Microsoft Windows"
+ objectSignerFlagsAdhoc:
+ - false
+ objectSignerFlagsLibValid:
+ - false
+ objectSignerFlagsRuntime:
+ - false
+ objectSignerValid:
+ - true
+ objectTrueType: 7
+ objectUser: "SYSTEM"
+ objectUserDomain: "NT AUTHORITY"
+ objectUserGroupSids:
+ - "S-1-16-16384"
+ - "S-1-1-0"
+ - "S-1-5-32-545"
+ - "S-1-5-6"
+ - "S-1-2-1"
+ - "S-1-5-11"
+ - "S-1-5-15"
+ - "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966"
+ - "S-1-5-5-0-36366980"
+ - "S-1-2-0"
+ - "S-1-5-32-544"
+ osDescription: "Windows 10 Pro (64 bit) build 19045"
+ osName: "Windows"
+ osType: "0x00000030"
+ osVer: "10.0.19045"
+ parentAuthId: "999"
+ parentCmd: "system32\\services.exe"
+ parentFileCreation: "1722281953380"
+ parentFileHashId: "-4092577940452904134"
+ parentFileHashMd5: "4eacbe64bb1e7d58e8a26340ed1c7cbd"
+ parentFileHashSha1: "6703d48349de8c836c0eaffac5cfac7679da7f60"
+ parentFileHashSha256: "1efd9a81b2ddf21b3f327d67a6f8f88f814979e84085ec812af72450310d4281"
+ parentFileModifiedTime: "1722281953458"
+ parentFilePath: "System32\\services.exe"
+ parentFileSize: "716544"
+ parentHashId: "-5897584668177803063"
+ parentIntegrityLevel: 16384
+ parentLaunchTime: "1722285790679"
+ parentName: "System32\\services.exe"
+ parentPid: 688
+ parentSessionId: 0
+ parentSigner:
+ - "Microsoft Windows Publisher"
+ parentSignerFlagsAdhoc:
+ - false
+ parentSignerFlagsLibValid:
+ - false
+ parentSignerFlagsRuntime:
+ - false
+ parentSignerValid:
+ - true
+ parentTrueType: 7
+ parentUser: "SYSTEM"
+ parentUserDomain: "NT AUTHORITY"
+ plang: 1
+ pname: "751"
+ pplat: 5889
+ processCmd: "system32\\msiexec.exe /V"
+ processFileCreation: "1722282337759"
+ processFileHashId: "-5659244633155638992"
+ processFileHashMd5: "78912ea8790de51d2c7ceb9b8c572346"
+ processFileHashSha1: "6a795b8a432514f20ff884f1a5286ea82e32e150"
+ processFileHashSha256: "d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb"
+ processFileModifiedTime: "1722282337774"
+ processFilePath: "System32\\msiexec.exe"
+ processFileSize: "69632"
+ processHashId: "7052107378290747991"
+ processLaunchTime: "1722356422814"
+ processName: "System32\\msiexec.exe"
+ processPid: 408
+ processSigner:
+ - "Microsoft Windows"
+ processSignerFlagsAdhoc:
+ - false
+ processSignerFlagsLibValid:
+ - false
+ processSignerFlagsRuntime:
+ - false
+ processSignerValid:
+ - true
+ processTrueType: 7
+ processUser: "SYSTEM"
+ processUserDomain: "NT AUTHORITY"
+ processUserGroupSids:
+ - "S-1-16-16384"
+ - "S-1-1-0"
+ - "S-1-5-32-545"
+ - "S-1-5-6"
+ - "S-1-2-1"
+ - "S-1-5-11"
+ - "S-1-5-15"
+ - "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966"
+ - "S-1-5-5-0-36366980"
+ - "S-1-2-0"
+ - "S-1-5-32-544"
+ productCode: "xes"
+ pver: "1.2.0.5259"
+ sessionId: 0
+ tags:
+ - "MITRE.T1053.005"
+ - "XSAE.F1507"
+ - "MITRE.T1053"
+ timezone: "UTC+05:30"
+ uuid: "65f9d8c7-33a9-41a3-a1a6-445376599211"
+ detectedDateTime: "2024-07-30T16:20:25Z"
+ endpoint:
+ agentGuid: "801b7e5f-902e-4ebd-ad6a-c8f431fe6053"
+ endpointName: "DESKTOP-N19I543"
+ ips:
+ - "ab80::42jk:a793:2667:b585"
+ - "10.10.10.10"
+ entityName: "DESKTOP-N19I543(ab80::42jk:a793:2667:b585,10.10.10.10)"
+ entityType: "endpoint"
+ event_type: "EVENT_PROCESS"
+ filters:
+ -
+ riskLevel: "low"
+ mitreTacticIds:
+ - "TA0002"
+ - "TA0003"
+ - "TA0004"
+ mitreTechniqueIds:
+ - "T1053"
+ - "T1053.005"
+ name: "Creation of Scheduled Task"
+ description: "A scheduled task was created via command-line"
+ id: "F1507"
+ highlightedObjects:
+ -
+ field: "objectCmd"
+ type: "command_line"
+ value: "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F"
+ -
+ field: "processCmd"
+ type: "command_line"
+ value: "system32\\msiexec.exe /V"
+ type: "preset"
+ ingestedDateTime: "2024-07-30T16:22:16Z"
+ oat_event_severity: "Info"
+ source: "endpointActivityData"
+ uuid: "65f9d8c7-33a9-41a3-a1a6-445376599211"
+ message: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "801b7e5f-902e-4ebd-ad6a-c8f431fe6053",
+ "endpointName" : "DESKTOP-N19I543",
+ "ips" : [ "ab80::42jk:a793:2667:b585", "10.10.10.10" ]
+ },
+ "detectedDateTime" : "2024-07-30T16:20:25Z",
+ "entityType" : "endpoint",
+ "entityName" : "DESKTOP-N19I543(ab80::42jk:a793:2667:b585,10.10.10.10)",
+ "source" : "endpointActivityData",
+ "filters" : [ {
+ "riskLevel" : "low",
+ "mitreTacticIds" : [ "TA0002", "TA0003", "TA0004" ],
+ "mitreTechniqueIds" : [ "T1053", "T1053.005" ],
+ "name" : "Creation of Scheduled Task",
+ "description" : "A scheduled task was created via command-line",
+ "id" : "F1507",
+ "highlightedObjects" : [ {
+ "field" : "objectCmd",
+ "type" : "command_line",
+ "value" : "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F"
+ }, {
+ "field" : "processCmd",
+ "type" : "command_line",
+ "value" : "system32\\msiexec.exe /V"
+ } ],
+ "type" : "preset"
+ } ],
+ "detail" : {
+ "processFileHashSha256" : "d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb",
+ "processUserDomain" : "NT AUTHORITY",
+ "eventSubId" : 2,
+ "plang" : 1,
+ "pver" : "1.2.0.5259",
+ "objectSignerFlagsRuntime" : [ false ],
+ "processSignerFlagsLibValid" : [ false ],
+ "objectTrueType" : 7,
+ "processFileSize" : "69632",
+ "endpointHostName" : "DESKTOP-N19I543",
+ "objectSessionId" : "0",
+ "parentFilePath" : "System32\\services.exe",
+ "processLaunchTime" : "1722356422814",
+ "objectHashId" : "148323463451116793",
+ "eventSourceType" : 1,
+ "objectIntegrityLevel" : 16384,
+ "objectRunAsLocalAccount" : false,
+ "tags" : [ "MITRE.T1053.005", "XSAE.F1507", "MITRE.T1053" ],
+ "parentName" : "System32\\services.exe",
+ "lastSeen" : "1722356425050",
+ "parentSignerFlagsLibValid" : [ false ],
+ "objectUser" : "SYSTEM",
+ "objectFileCreation" : "1722282120740",
+ "osDescription" : "Windows 10 Pro (64 bit) build 19045",
+ "objectCmd" : "SysWOW64\\schtasks.exe -create -tn Microsoft\\Windows\\WindowsUpdate\\RUXIM\\PLUGScheduler -xml plugscheduler.xml -F",
+ "osVer" : "10.0.19045",
+ "processSigner" : [ "Microsoft Windows" ],
+ "parentCmd" : "system32\\services.exe",
+ "endpointMacAddress" : [ "00:0d:30:e4:8b:b6" ],
+ "parentFileCreation" : "1722281953380",
+ "processFileHashMd5" : "78912ea8790de51d2c7ceb9b8c572346",
+ "processCmd" : "system32\\msiexec.exe /V",
+ "processUserGroupSids" : [ "S-1-16-16384", "S-1-1-0", "S-1-5-32-545", "S-1-5-6", "S-1-2-1", "S-1-5-11", "S-1-5-15", "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966", "S-1-5-5-0-36366980", "S-1-2-0", "S-1-5-32-544" ],
+ "parentSessionId" : 0,
+ "parentFileHashId" : "-4092577940452904134",
+ "sessionId" : 0,
+ "processFilePath" : "System32\\msiexec.exe",
+ "osName" : "Windows",
+ "productCode" : "xes",
+ "parentFileHashSha256" : "1efd9a81b2ddf21b3f327d67a6f8f88f814979e84085ec812af72450310d4281",
+ "processFileHashSha1" : "6a795b8a432514f20ff884f1a5286ea82e32e150",
+ "processTrueType" : 7,
+ "objectFileHashId" : "-370955917314104624",
+ "objectFileSize" : "187904",
+ "parentHashId" : "-5897584668177803063",
+ "parentSignerValid" : [ true ],
+ "uuid" : "65f9d8c7-33a9-41a3-a1a6-445376599211",
+ "parentUserDomain" : "NT AUTHORITY",
+ "eventHashId" : "-8250022594686035748",
+ "processSignerValid" : [ true ],
+ "parentFileModifiedTime" : "1722281953458",
+ "objectFileHashSha256" : "29f6fc1bb0e68cb4fc1ec597604ec5aca7fcef7d0d9241218596d941f04f16e7",
+ "processName" : "System32\\msiexec.exe",
+ "parentSignerFlagsAdhoc" : [ false ],
+ "parentAuthId" : "999",
+ "objectFileHashMd5" : "db6f48dc66879299b49ee3f1df0607f1",
+ "filterRiskLevel" : "low",
+ "eventId" : "1",
+ "firstSeen" : "1722356425050",
+ "objectFilePath" : "SysWOW64\\schtasks.exe",
+ "pname" : "751",
+ "parentLaunchTime" : "1722285790679",
+ "parentFileHashMd5" : "4eacbe64bb1e7d58e8a26340ed1c7cbd",
+ "processSignerFlagsAdhoc" : [ false ],
+ "objectSigner" : [ "Microsoft Windows" ],
+ "processPid" : 408,
+ "parentSigner" : [ "Microsoft Windows Publisher" ],
+ "objectSignerFlagsLibValid" : [ false ],
+ "integrityLevel" : 16384,
+ "processFileModifiedTime" : "1722282337774",
+ "objectFileHashSha1" : "5673be4c0b3d6c963651ec1e4adb7aaabadf5a19",
+ "pplat" : 5889,
+ "parentSignerFlagsRuntime" : [ false ],
+ "parentIntegrityLevel" : 16384,
+ "processSignerFlagsRuntime" : [ false ],
+ "objectLaunchTime" : "1722356425049",
+ "objectUserGroupSids" : [ "S-1-16-16384", "S-1-1-0", "S-1-5-32-545", "S-1-5-6", "S-1-2-1", "S-1-5-11", "S-1-5-15", "S-1-5-80-685333868-2237257676-1431965530-1907094206-2438021966", "S-1-5-5-0-36366980", "S-1-2-0", "S-1-5-32-544" ],
+ "timezone" : "UTC+05:30",
+ "processUser" : "SYSTEM",
+ "logReceivedTime" : "1722356504612",
+ "objectSignerFlagsAdhoc" : [ false ],
+ "authId" : "999",
+ "osType" : "0x00000030",
+ "processFileCreation" : "1722282337759",
+ "objectUserDomain" : "NT AUTHORITY",
+ "processHashId" : "7052107378290747991",
+ "parentPid" : 688,
+ "endpointIp" : [ "ab80::42jk:a793:2667:b585", "10.10.10.10" ],
+ "objectSignerValid" : [ true ],
+ "parentTrueType" : 7,
+ "parentFileSize" : "716544",
+ "parentFileHashSha1" : "6703d48349de8c836c0eaffac5cfac7679da7f60",
+ "objectAuthId" : "999",
+ "endpointGuid" : "801b7e5f-902e-4ebd-ad6a-c8f431fe6053",
+ "objectName" : "SysWOW64\\schtasks.exe",
+ "processFileHashId" : "-5659244633155638992",
+ "objectPid" : 6292,
+ "parentUser" : "SYSTEM",
+ "objectFileModifiedTime" : "1722282120756"
+ },
+ "ingestedDateTime" : "2024-07-30T16:22:16Z",
+ "uuid" : "65f9d8c7-33a9-41a3-a1a6-445376599211"
+ }
+ service: "observed-attack-techniques"
+ status: "info"
+ tags:
+ - "source:LOGS_SOURCE"
+ timestamp: 1722356425000
+ -
+ sample: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "b159820e-5bb3-49f2-ad98-75a4f2052282",
+ "endpointName" : "ASSETTAG-EID",
+ "ips" : [ "10.10.10.10" ]
+ },
+ "detectedDateTime" : "2024-07-31T05:00:44Z",
+ "entityType" : "endpoint",
+ "entityName" : "ASSETTAG-EID(10.10.10.10)",
+ "source" : "identityActivityData",
+ "filters" : [ {
+ "riskLevel" : "medium",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1204.002" ],
+ "name" : "Malicious Software",
+ "description" : "A malicious software was detected on an endpoint.",
+ "id" : "F2140",
+ "highlightedObjects" : [ {
+ "field" : "fileHash",
+ "type" : "file_sha1",
+ "value" : "527a3b861f37d16d356250f9e9bad4c43a850ebf"
+ }, {
+ "field" : "fileName",
+ "type" : "filename",
+ "value" : [ "Unconfirmed 667870.crdownload" ]
+ }, {
+ "field" : "fullPath",
+ "type" : "fullpath",
+ "value" : "\\Downloads\\Unconfirmed 667870.crdownload"
+ }, {
+ "field" : "malName",
+ "type" : "detection_name",
+ "value" : "TROJ_GEN.R03BC0PG624"
+ }, {
+ "field" : "actResult",
+ "type" : "text",
+ "value" : [ "Encrypted" ]
+ }, {
+ "field" : "scanType",
+ "type" : "text",
+ "value" : "Real-time Scan"
+ }, {
+ "field" : "endpointIp",
+ "type" : "ip",
+ "value" : [ "10.10.10.10" ]
+ } ],
+ "type" : "preset"
+ } ],
+ "detail" : {
+ "idpName" : "GTPL",
+ "eventCategory" : "Media and Entertainment",
+ "groupId" : "3g35av3545",
+ "eventAdditionalDetails" : "This is test sentence.",
+ "statusDetail" : "Log In",
+ "uuid" : "31f42842-e527-443a-bb9d-1918c0f65342",
+ "statusReason" : "Logged In",
+ "initiatedByServicePrincipalId" : "234eer345",
+ "locationCountry" : "Sweden",
+ "initiatedByAppDisplayName" : "Outlook",
+ "bitwiseFilterRiskLevel" : 2,
+ "locationLongitude" : "59.3293",
+ "eventName" : "The Detected Malware Scan",
+ "loggedByService" : "Microfost",
+ "filterRiskLevel" : "medium",
+ "locationState" : "Gotland",
+ "targetResources" : "Outlook Application.",
+ "eventId" : "214sf3445",
+ "initiatedByUserId" : "3424455d345",
+ "pname" : "2345wwy48",
+ "ipAddress" : "10.10.10.10",
+ "initiatedByUserPrincipalName" : "FIGI-ED",
+ "eventSourceType" : 3,
+ "version" : "2.1",
+ "tenantGuid" : "322434d344qd341",
+ "tags" : [ "1", "2" ],
+ "targetResourceDisplayName" : "Facetime",
+ "mgmtInstanceId" : "dsa92j2424e",
+ "targetResourceId" : "23e2t42w34",
+ "clientDisplayName" : "Microfost",
+ "operationType" : "Scanning",
+ "locationCity" : "Stockholm",
+ "status" : "Open",
+ "actionName" : "Sign Out",
+ "idpId" : "2",
+ "requestMethod" : "2 Way Authentication",
+ "clientOS" : "Windows 11",
+ "initiatedByAppId" : "33245",
+ "tmFilterRiskLevel" : "High",
+ "result" : "Fail",
+ "clientBrowser" : "Google Chrome",
+ "partitionKey" : "34787654324567890987",
+ "customFilterTags" : "scan",
+ "initiatedByUserDisplayName" : "John",
+ "clientApp" : "Outlook",
+ "initiatedByUserHomeTenantName" : "Hugh",
+ "resultReason" : "Malware Found.",
+ "customerId" : "191648c0f65342",
+ "packageTraceId" : "3e4rr245",
+ "correlationId" : "234r34r542w13",
+ "initiatedByUserIpAddress" : "10.10.10.10",
+ "clientId" : "de249o34",
+ "locationLatitude" : "18.0686",
+ "userDisplayName" : "Jordan",
+ "userAgent" : "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41",
+ "userId" : "23fd34w4",
+ "initiatedByUserHomeTenantId" : "3245de344",
+ "productCode" : "aad",
+ "customFilterRiskLevel" : "High",
+ "receivedTime" : "2024-07-31T07:01:44Z",
+ "initiatedByServicePrincipalName" : "ETTES-ER",
+ "policyTreePath" : "C:\\desktop\\malware.sys"
+ },
+ "ingestedDateTime" : "2024-07-31T05:00:49Z",
+ "uuid" : "31f42842-e527-443a-bb9d-1918c0f65342"
+ }
+ service: "observed-attack-techniques"
+ result:
+ custom:
+ detail:
+ actionName: "Sign Out"
+ bitwiseFilterRiskLevel: 2
+ clientApp: "Outlook"
+ clientBrowser: "Google Chrome"
+ clientDisplayName: "Microfost"
+ clientId: "de249o34"
+ clientOS: "Windows 11"
+ correlationId: "234r34r542w13"
+ customFilterRiskLevel: "High"
+ customFilterTags: "scan"
+ customerId: "191648c0f65342"
+ eventAdditionalDetails: "This is test sentence."
+ eventCategory: "Media and Entertainment"
+ eventId: "214sf3445"
+ eventName: "The Detected Malware Scan"
+ eventSourceType: 3
+ filterRiskLevel: "medium"
+ groupId: "3g35av3545"
+ idpId: "2"
+ idpName: "GTPL"
+ initiatedByAppDisplayName: "Outlook"
+ initiatedByAppId: "33245"
+ initiatedByServicePrincipalId: "234eer345"
+ initiatedByServicePrincipalName: "ETTES-ER"
+ initiatedByUserDisplayName: "John"
+ initiatedByUserHomeTenantId: "3245de344"
+ initiatedByUserHomeTenantName: "Hugh"
+ initiatedByUserId: "3424455d345"
+ initiatedByUserIpAddress: "10.10.10.10"
+ initiatedByUserPrincipalName: "FIGI-ED"
+ locationCity: "Stockholm"
+ locationCountry: "Sweden"
+ locationLatitude: "18.0686"
+ locationLongitude: "59.3293"
+ locationState: "Gotland"
+ loggedByService: "Microfost"
+ mgmtInstanceId: "dsa92j2424e"
+ operationType: "Scanning"
+ packageTraceId: "3e4rr245"
+ partitionKey: "34787654324567890987"
+ pname: "2345wwy48"
+ policyTreePath: "C:\\desktop\\malware.sys"
+ productCode: "aad"
+ receivedTime: "2024-07-31T07:01:44Z"
+ requestMethod: "2 Way Authentication"
+ result: "Fail"
+ resultReason: "Malware Found."
+ status: "Open"
+ statusDetail: "Log In"
+ statusReason: "Logged In"
+ tags:
+ - "1"
+ - "2"
+ targetResourceDisplayName: "Facetime"
+ targetResourceId: "23e2t42w34"
+ targetResources: "Outlook Application."
+ tenantGuid: "322434d344qd341"
+ tmFilterRiskLevel: "High"
+ userAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41"
+ uuid: "31f42842-e527-443a-bb9d-1918c0f65342"
+ version: "2.1"
+ detectedDateTime: "2024-07-31T05:00:44Z"
+ endpoint:
+ agentGuid: "b159820e-5bb3-49f2-ad98-75a4f2052282"
+ endpointName: "ASSETTAG-EID"
+ ips:
+ - "10.10.10.10"
+ entityName: "ASSETTAG-EID(10.10.10.10)"
+ entityType: "endpoint"
+ filters:
+ -
+ riskLevel: "medium"
+ mitreTacticIds:
+ - "TA0002"
+ mitreTechniqueIds:
+ - "T1204.002"
+ name: "Malicious Software"
+ description: "A malicious software was detected on an endpoint."
+ id: "F2140"
+ highlightedObjects:
+ -
+ field: "fileHash"
+ type: "file_sha1"
+ value: "527a3b861f37d16d356250f9e9bad4c43a850ebf"
+ -
+ field: "fileName"
+ type: "filename"
+ value:
+ - "Unconfirmed 667870.crdownload"
+ -
+ field: "fullPath"
+ type: "fullpath"
+ value: "\\Downloads\\Unconfirmed 667870.crdownload"
+ -
+ field: "malName"
+ type: "detection_name"
+ value: "TROJ_GEN.R03BC0PG624"
+ -
+ field: "actResult"
+ type: "text"
+ value:
+ - "Encrypted"
+ -
+ field: "scanType"
+ type: "text"
+ value: "Real-time Scan"
+ -
+ field: "endpointIp"
+ type: "ip"
+ value:
+ - "10.10.10.10"
+ type: "preset"
+ ingestedDateTime: "2024-07-31T05:00:49Z"
+ network:
+ client:
+ geoip: {}
+ ip: "10.10.10.10"
+ oat_event_severity: "Notice"
+ source: "identityActivityData"
+ usr:
+ id: "23fd34w4"
+ name: "Jordan"
+ uuid: "31f42842-e527-443a-bb9d-1918c0f65342"
+ message: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "b159820e-5bb3-49f2-ad98-75a4f2052282",
+ "endpointName" : "ASSETTAG-EID",
+ "ips" : [ "10.10.10.10" ]
+ },
+ "detectedDateTime" : "2024-07-31T05:00:44Z",
+ "entityType" : "endpoint",
+ "entityName" : "ASSETTAG-EID(10.10.10.10)",
+ "source" : "identityActivityData",
+ "filters" : [ {
+ "riskLevel" : "medium",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1204.002" ],
+ "name" : "Malicious Software",
+ "description" : "A malicious software was detected on an endpoint.",
+ "id" : "F2140",
+ "highlightedObjects" : [ {
+ "field" : "fileHash",
+ "type" : "file_sha1",
+ "value" : "527a3b861f37d16d356250f9e9bad4c43a850ebf"
+ }, {
+ "field" : "fileName",
+ "type" : "filename",
+ "value" : [ "Unconfirmed 667870.crdownload" ]
+ }, {
+ "field" : "fullPath",
+ "type" : "fullpath",
+ "value" : "\\Downloads\\Unconfirmed 667870.crdownload"
+ }, {
+ "field" : "malName",
+ "type" : "detection_name",
+ "value" : "TROJ_GEN.R03BC0PG624"
+ }, {
+ "field" : "actResult",
+ "type" : "text",
+ "value" : [ "Encrypted" ]
+ }, {
+ "field" : "scanType",
+ "type" : "text",
+ "value" : "Real-time Scan"
+ }, {
+ "field" : "endpointIp",
+ "type" : "ip",
+ "value" : [ "10.10.10.10" ]
+ } ],
+ "type" : "preset"
+ } ],
+ "detail" : {
+ "idpName" : "GTPL",
+ "eventCategory" : "Media and Entertainment",
+ "groupId" : "3g35av3545",
+ "eventAdditionalDetails" : "This is test sentence.",
+ "statusDetail" : "Log In",
+ "uuid" : "31f42842-e527-443a-bb9d-1918c0f65342",
+ "statusReason" : "Logged In",
+ "initiatedByServicePrincipalId" : "234eer345",
+ "locationCountry" : "Sweden",
+ "initiatedByAppDisplayName" : "Outlook",
+ "bitwiseFilterRiskLevel" : 2,
+ "locationLongitude" : "59.3293",
+ "eventName" : "The Detected Malware Scan",
+ "loggedByService" : "Microfost",
+ "filterRiskLevel" : "medium",
+ "locationState" : "Gotland",
+ "targetResources" : "Outlook Application.",
+ "eventId" : "214sf3445",
+ "initiatedByUserId" : "3424455d345",
+ "pname" : "2345wwy48",
+ "ipAddress" : "10.10.10.10",
+ "initiatedByUserPrincipalName" : "FIGI-ED",
+ "eventSourceType" : 3,
+ "version" : "2.1",
+ "tenantGuid" : "322434d344qd341",
+ "tags" : [ "1", "2" ],
+ "targetResourceDisplayName" : "Facetime",
+ "mgmtInstanceId" : "dsa92j2424e",
+ "targetResourceId" : "23e2t42w34",
+ "clientDisplayName" : "Microfost",
+ "operationType" : "Scanning",
+ "locationCity" : "Stockholm",
+ "status" : "Open",
+ "actionName" : "Sign Out",
+ "idpId" : "2",
+ "requestMethod" : "2 Way Authentication",
+ "clientOS" : "Windows 11",
+ "initiatedByAppId" : "33245",
+ "tmFilterRiskLevel" : "High",
+ "result" : "Fail",
+ "clientBrowser" : "Google Chrome",
+ "partitionKey" : "34787654324567890987",
+ "customFilterTags" : "scan",
+ "initiatedByUserDisplayName" : "John",
+ "clientApp" : "Outlook",
+ "initiatedByUserHomeTenantName" : "Hugh",
+ "resultReason" : "Malware Found.",
+ "customerId" : "191648c0f65342",
+ "packageTraceId" : "3e4rr245",
+ "correlationId" : "234r34r542w13",
+ "initiatedByUserIpAddress" : "10.10.10.10",
+ "clientId" : "de249o34",
+ "locationLatitude" : "18.0686",
+ "userDisplayName" : "Jordan",
+ "userAgent" : "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41",
+ "userId" : "23fd34w4",
+ "initiatedByUserHomeTenantId" : "3245de344",
+ "productCode" : "aad",
+ "customFilterRiskLevel" : "High",
+ "receivedTime" : "2024-07-31T07:01:44Z",
+ "initiatedByServicePrincipalName" : "ETTES-ER",
+ "policyTreePath" : "C:\\desktop\\malware.sys"
+ },
+ "ingestedDateTime" : "2024-07-31T05:00:49Z",
+ "uuid" : "31f42842-e527-443a-bb9d-1918c0f65342"
+ }
+ service: "observed-attack-techniques"
+ status: "notice"
+ tags:
+ - "source:LOGS_SOURCE"
+ timestamp: 1722402044000
+ -
+ sample: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "cedddc75-d673-4ba0-a1f6-cf6b05a84670",
+ "endpointName" : "LAB-Luwak-1048",
+ "ips" : [ "10.10.10.10", "fe70::9457:af15:b645:35os" ]
+ },
+ "entityType" : "endpoint",
+ "entityName" : "desktop-17",
+ "detectedDateTime" : "2020-06-01T02:12:56Z",
+ "source" : "cloudActivityData",
+ "filters" : [ {
+ "riskLevel" : "info",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1560.002" ],
+ "name" : "Service Execution via Service Control Manager",
+ "description" : "Service Control Manager (services.exe) has executed a process",
+ "id" : "F4231",
+ "highlightedObjects" : [ {
+ "field" : "objectPort",
+ "type" : "port",
+ "value" : 443
+ } ],
+ "type" : "custom"
+ } ],
+ "detail" : {
+ "eventID" : "1234567890abcdef",
+ "awsRegion" : "us-east-1",
+ "eventSubId" : "1234567890abcdef",
+ "eventCategory" : "Management",
+ "eventVersion" : "1.08",
+ "responseElements" : "{\"User\":{\"UserName\":\"JohnDoe\"}}",
+ "sourceIPAddress" : "10.10.10.10",
+ "eventSource" : "iam.amazonaws.com",
+ "readOnly" : false,
+ "userAgent" : "aws-cli/2.7.24 Python/3.9.7 Linux/5.10.104-1-MANJARO",
+ "eventType" : "AwsApiCall",
+ "uuid" : "1234567890abcdef",
+ "productCode" : "",
+ "requestID" : "1234567890abcdef",
+ "customerId" : "1234567890",
+ "eventName" : "CreateUser",
+ "packageTraceId" : "1234567890abcdef",
+ "recipientAccountId" : "1234567890",
+ "managementEvent" : true,
+ "filterRiskLevel" : "info",
+ "eventCase" : "CreateUser-1234567890"
+ },
+ "ingestedDateTime" : "2020-06-01T02:12:56Z",
+ "uuid" : "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ }
+ service: "observed-attack-techniques"
+ result:
+ custom:
+ detail:
+ awsRegion: "us-east-1"
+ customerId: "1234567890"
+ eventCase: "CreateUser-1234567890"
+ eventCategory: "Management"
+ eventID: "1234567890abcdef"
+ eventName: "CreateUser"
+ eventSource: "iam.amazonaws.com"
+ eventSubId: "1234567890abcdef"
+ eventType: "AwsApiCall"
+ eventVersion: "1.08"
+ filterRiskLevel: "info"
+ managementEvent: true
+ packageTraceId: "1234567890abcdef"
+ productCode: ""
+ readOnly: false
+ recipientAccountId: "1234567890"
+ requestID: "1234567890abcdef"
+ responseElements: "{\"User\":{\"UserName\":\"JohnDoe\"}}"
+ userAgent: "aws-cli/2.7.24 Python/3.9.7 Linux/5.10.104-1-MANJARO"
+ uuid: "1234567890abcdef"
+ detectedDateTime: "2020-06-01T02:12:56Z"
+ endpoint:
+ agentGuid: "cedddc75-d673-4ba0-a1f6-cf6b05a84670"
+ endpointName: "LAB-Luwak-1048"
+ ips:
+ - "10.10.10.10"
+ - "fe70::9457:af15:b645:35os"
+ entityName: "desktop-17"
+ entityType: "endpoint"
+ filters:
+ -
+ riskLevel: "info"
+ mitreTacticIds:
+ - "TA0002"
+ mitreTechniqueIds:
+ - "T1560.002"
+ name: "Service Execution via Service Control Manager"
+ description: "Service Control Manager (services.exe) has executed a process"
+ id: "F4231"
+ highlightedObjects:
+ -
+ field: "objectPort"
+ type: "port"
+ value: 443
+ type: "custom"
+ ingestedDateTime: "2020-06-01T02:12:56Z"
+ network:
+ client:
+ geoip: {}
+ ip: "10.10.10.10"
+ oat_event_severity: "Debug"
+ source: "cloudActivityData"
+ uuid: "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ message: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "cedddc75-d673-4ba0-a1f6-cf6b05a84670",
+ "endpointName" : "LAB-Luwak-1048",
+ "ips" : [ "10.10.10.10", "fe70::9457:af15:b645:35os" ]
+ },
+ "entityType" : "endpoint",
+ "entityName" : "desktop-17",
+ "detectedDateTime" : "2020-06-01T02:12:56Z",
+ "source" : "cloudActivityData",
+ "filters" : [ {
+ "riskLevel" : "info",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1560.002" ],
+ "name" : "Service Execution via Service Control Manager",
+ "description" : "Service Control Manager (services.exe) has executed a process",
+ "id" : "F4231",
+ "highlightedObjects" : [ {
+ "field" : "objectPort",
+ "type" : "port",
+ "value" : 443
+ } ],
+ "type" : "custom"
+ } ],
+ "detail" : {
+ "eventID" : "1234567890abcdef",
+ "awsRegion" : "us-east-1",
+ "eventSubId" : "1234567890abcdef",
+ "eventCategory" : "Management",
+ "eventVersion" : "1.08",
+ "responseElements" : "{\"User\":{\"UserName\":\"JohnDoe\"}}",
+ "sourceIPAddress" : "10.10.10.10",
+ "eventSource" : "iam.amazonaws.com",
+ "readOnly" : false,
+ "userAgent" : "aws-cli/2.7.24 Python/3.9.7 Linux/5.10.104-1-MANJARO",
+ "eventType" : "AwsApiCall",
+ "uuid" : "1234567890abcdef",
+ "productCode" : "",
+ "requestID" : "1234567890abcdef",
+ "customerId" : "1234567890",
+ "eventName" : "CreateUser",
+ "packageTraceId" : "1234567890abcdef",
+ "recipientAccountId" : "1234567890",
+ "managementEvent" : true,
+ "filterRiskLevel" : "info",
+ "eventCase" : "CreateUser-1234567890"
+ },
+ "ingestedDateTime" : "2020-06-01T02:12:56Z",
+ "uuid" : "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ }
+ service: "observed-attack-techniques"
+ status: "debug"
+ tags:
+ - "source:LOGS_SOURCE"
+ timestamp: 1590977576000
+ -
+ sample: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "endpointName" : "LAB-Luwak-1048",
+ "ips" : [ "10.10.10.10", "fe78::1542:af77:b312:35ea" ]
+ },
+ "entityType" : "endpoint",
+ "entityName" : "desktop-17",
+ "detectedDateTime" : "2020-06-01T02:12:56Z",
+ "source" : "networkActivityData",
+ "filters" : [ {
+ "riskLevel" : "info",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1560.002" ],
+ "name" : "Service Execution via Service Control Manager",
+ "description" : "Service Control Manager (services.exe) has executed a process",
+ "id" : "F4231",
+ "highlightedObjects" : [ {
+ "field" : "objectPort",
+ "type" : "port",
+ "value" : 443
+ } ],
+ "type" : "custom"
+ } ],
+ "detail" : {
+ "request" : "https://www.example.com",
+ "rt" : 1643723400,
+ "fileName" : "dummy-file.exe",
+ "serverTls" : "TLSv1.2",
+ "dst" : "8.8.8.8",
+ "requestBase" : "example.com",
+ "requestMethod" : "GET",
+ "pver" : "1.0",
+ "companyName" : "Example Inc.",
+ "fileHash" : "sample-filehash",
+ "serverProtocol" : "HTTP/1.1",
+ "suid" : "admin",
+ "mimeType" : "application/x-msdownload",
+ "duration" : 100,
+ "score" : 50,
+ "endpointHostName" : "dummy-host",
+ "act" : "2",
+ "ruleUuid" : "sample-ruleuuid",
+ "deviceGUID" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "ruleType" : " dummy-rule-type",
+ "eventName" : " dummy-event",
+ "ruleName" : " dummy-rule",
+ "filterRiskLevel" : "info",
+ "objectId" : "sample-objectuuid",
+ "src" : "10.10.10.10",
+ "pname" : " dummy-product",
+ "fileHashSha256" : "sample-filehashsha256",
+ "malName" : " dummy-malware",
+ "profile" : " dummy-profile",
+ "start" : 1643723400,
+ "dpt" : 443,
+ "principalName" : "admin",
+ "userAgent" : "Mozilla/5.0",
+ "requestMimeType" : "text/html",
+ "userDomain" : "example.com",
+ "osName" : "Windows 10",
+ "tenantGuid" : "nisdds75-d673-4ba0-a1f6-cf6b05a46152",
+ "eventSubName" : " dummy-sub-event",
+ "policyUuid" : "sample-policyuuid",
+ "detectionType" : " dummy-detection",
+ "application" : "Example App",
+ "fileSize" : "1024",
+ "sender" : "gateway",
+ "spt" : 443,
+ "clientIp" : "10.10.10.10",
+ "endpointGuid" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "userDepartment" : "IT",
+ "fileType" : "application/x-msdownload"
+ },
+ "ingestedDateTime" : "2020-06-01T02:12:56Z",
+ "uuid" : "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ }
+ service: "observed-attack-techniques"
+ result:
+ custom:
+ detail:
+ act: "2"
+ application: "Example App"
+ clientIp: "10.10.10.10"
+ companyName: "Example Inc."
+ detectionType: " dummy-detection"
+ deviceGUID: "ceddds65-d673-4ba0-a1f6-cf6b05a46152"
+ duration: 100
+ endpointGuid: "ceddds65-d673-4ba0-a1f6-cf6b05a46152"
+ endpointHostName: "dummy-host"
+ eventName: " dummy-event"
+ eventSubName: " dummy-sub-event"
+ fileHash: "sample-filehash"
+ fileHashSha256: "sample-filehashsha256"
+ fileName: "dummy-file.exe"
+ fileSize: "1024"
+ fileType: "application/x-msdownload"
+ filterRiskLevel: "info"
+ malName: " dummy-malware"
+ mimeType: "application/x-msdownload"
+ objectId: "sample-objectuuid"
+ osName: "Windows 10"
+ pname: " dummy-product"
+ policyUuid: "sample-policyuuid"
+ principalName: "admin"
+ profile: " dummy-profile"
+ pver: "1.0"
+ request: "https://www.example.com"
+ requestBase: "example.com"
+ requestMethod: "GET"
+ requestMimeType: "text/html"
+ rt: 1643723400
+ ruleName: " dummy-rule"
+ ruleType: " dummy-rule-type"
+ ruleUuid: "sample-ruleuuid"
+ score: 50
+ sender: "gateway"
+ serverProtocol: "HTTP/1.1"
+ serverTls: "TLSv1.2"
+ start: 1643723400
+ suid: "admin"
+ tenantGuid: "nisdds75-d673-4ba0-a1f6-cf6b05a46152"
+ userAgent: "Mozilla/5.0"
+ userDepartment: "IT"
+ userDomain: "example.com"
+ detectedDateTime: "2020-06-01T02:12:56Z"
+ endpoint:
+ agentGuid: "ceddds65-d673-4ba0-a1f6-cf6b05a46152"
+ endpointName: "LAB-Luwak-1048"
+ ips:
+ - "10.10.10.10"
+ - "fe78::1542:af77:b312:35ea"
+ entityName: "desktop-17"
+ entityType: "endpoint"
+ filters:
+ -
+ riskLevel: "info"
+ mitreTacticIds:
+ - "TA0002"
+ mitreTechniqueIds:
+ - "T1560.002"
+ name: "Service Execution via Service Control Manager"
+ description: "Service Control Manager (services.exe) has executed a process"
+ id: "F4231"
+ highlightedObjects:
+ -
+ field: "objectPort"
+ type: "port"
+ value: 443
+ type: "custom"
+ ingestedDateTime: "2020-06-01T02:12:56Z"
+ network:
+ client:
+ geoip: {}
+ ip: "10.10.10.10"
+ port: 443
+ destination:
+ ip: "8.8.8.8"
+ port: 443
+ oat_event_severity: "Debug"
+ source: "networkActivityData"
+ uuid: "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ message: |-
+ {
+ "endpoint" : {
+ "agentGuid" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "endpointName" : "LAB-Luwak-1048",
+ "ips" : [ "10.10.10.10", "fe78::1542:af77:b312:35ea" ]
+ },
+ "entityType" : "endpoint",
+ "entityName" : "desktop-17",
+ "detectedDateTime" : "2020-06-01T02:12:56Z",
+ "source" : "networkActivityData",
+ "filters" : [ {
+ "riskLevel" : "info",
+ "mitreTacticIds" : [ "TA0002" ],
+ "mitreTechniqueIds" : [ "T1560.002" ],
+ "name" : "Service Execution via Service Control Manager",
+ "description" : "Service Control Manager (services.exe) has executed a process",
+ "id" : "F4231",
+ "highlightedObjects" : [ {
+ "field" : "objectPort",
+ "type" : "port",
+ "value" : 443
+ } ],
+ "type" : "custom"
+ } ],
+ "detail" : {
+ "request" : "https://www.example.com",
+ "rt" : 1643723400,
+ "fileName" : "dummy-file.exe",
+ "serverTls" : "TLSv1.2",
+ "dst" : "8.8.8.8",
+ "requestBase" : "example.com",
+ "requestMethod" : "GET",
+ "pver" : "1.0",
+ "companyName" : "Example Inc.",
+ "fileHash" : "sample-filehash",
+ "serverProtocol" : "HTTP/1.1",
+ "suid" : "admin",
+ "mimeType" : "application/x-msdownload",
+ "duration" : 100,
+ "score" : 50,
+ "endpointHostName" : "dummy-host",
+ "act" : "2",
+ "ruleUuid" : "sample-ruleuuid",
+ "deviceGUID" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "ruleType" : " dummy-rule-type",
+ "eventName" : " dummy-event",
+ "ruleName" : " dummy-rule",
+ "filterRiskLevel" : "info",
+ "objectId" : "sample-objectuuid",
+ "src" : "10.10.10.10",
+ "pname" : " dummy-product",
+ "fileHashSha256" : "sample-filehashsha256",
+ "malName" : " dummy-malware",
+ "profile" : " dummy-profile",
+ "start" : 1643723400,
+ "dpt" : 443,
+ "principalName" : "admin",
+ "userAgent" : "Mozilla/5.0",
+ "requestMimeType" : "text/html",
+ "userDomain" : "example.com",
+ "osName" : "Windows 10",
+ "tenantGuid" : "nisdds75-d673-4ba0-a1f6-cf6b05a46152",
+ "eventSubName" : " dummy-sub-event",
+ "policyUuid" : "sample-policyuuid",
+ "detectionType" : " dummy-detection",
+ "application" : "Example App",
+ "fileSize" : "1024",
+ "sender" : "gateway",
+ "spt" : 443,
+ "clientIp" : "10.10.10.10",
+ "endpointGuid" : "ceddds65-d673-4ba0-a1f6-cf6b05a46152",
+ "userDepartment" : "IT",
+ "fileType" : "application/x-msdownload"
+ },
+ "ingestedDateTime" : "2020-06-01T02:12:56Z",
+ "uuid" : "fdd69d98-58de-4249-9871-2e1b233b72ff"
+ }
+ service: "observed-attack-techniques"
+ status: "debug"
+ tags:
+ - "source:LOGS_SOURCE"
+ timestamp: 1590977576000
diff --git a/trend_micro_vision_one_xdr/assets/trend-micro-vision-one-xdr.svg b/trend_micro_vision_one_xdr/assets/trend-micro-vision-one-xdr.svg
new file mode 100644
index 0000000000000..6abaea449f8be
--- /dev/null
+++ b/trend_micro_vision_one_xdr/assets/trend-micro-vision-one-xdr.svg
@@ -0,0 +1,5 @@
+
\ No newline at end of file
diff --git a/trend_micro_vision_one_xdr/images/trend_micro_vision_one_xdr_oat.png b/trend_micro_vision_one_xdr/images/trend_micro_vision_one_xdr_oat.png
new file mode 100644
index 0000000000000000000000000000000000000000..61d5f574684234ab02beb1cd8f33d163acd73788
GIT binary patch
literal 228420
zcmeFZcT|&G*Dv~D0SiS1L8=86=}Hml0#c+Zy%!<0&^v?xZUj_%7m(hh20||Z1gVh@
z2@nV%ozSENA(R{T`+a+F-}|0BzH$D$!b+C6XKGE}Xk;aVP5eox7K(PY+8G+VG0)HM8}#s{F=j7@E+I1$&_?
zP}tBa^iKCqv7_BsnUu#mN9^jVZ2`Ww91
zx3)Xxu-gdL^56SL**5(gl)sIPd7uPBCUAQIM_)gccQ^^Lu=$D&veW+FS-n@NBl1*%
zme=?VS=3%&E@=OxM-P;`uewj?;qvc^u%G(OBCSY;8?u@5aNMbzje3+
z^_^>@>g=X7;d%(1soP&Ip!U~JL;JQr_GkRjW({{cFk)WR`RsZYX$!-02Petnzd91%
zJm1LvI)D0W*yTWtiaXX(Z2Kl@28)4s$A@?S&irda6Qc23LSB2faOL=`GSAQdHqGSn
zwf4N08?i7JaI=LWAO`umq^@2+>`ixD#hpU^c6*+-)z>(UM{Ruw-QW^WEQ1q{r6fXy
zA`O(>W6?b}u0FEdsCF}4Tbv;|Rmi9uSFi&eh3WOssYK}++)HGnQCWBp)9g}W|JwUX
z4Xm@Arxo8C=?r!yc-Br?cTP9h0n?Fr$$aci5qeU3B|jkskLTYAgA_7%DE~pE3&pva
zk)&PV8TPr5p3HOb7U5e3Z&!xdrm)5j85xvD)-CP;iUeH}C+jBE6G!iNrZ9(0@~sW|
z1I@bqNluHghfC0p*7_1-g`K9|jxG=14eQ^_E^W}=NHtuk@QdeLDGgm{^;D<3^)$XO
zp%DWs!!KN^Tf|EY5%7%j(zsv7UXV1dN1n7-V)(=*YPx0w)A}2qm~8XZNt5!}UP8c<
zxv8F|L)l2F;}djH(pg}%ZYp0fBBwLZ0;e?TW46~ypYZ3
z5UXKA_7C0HZ7_@F2Ie1LXer>wK>+ZUC>Sg4U3SXf1R-hA>|f)}|17F`<@5f^gEXKv
zQEV&UU_LINRuRE3$OQ3E^XZ^`+lI8U4V$DEc$|#tnNi}|xb&z^Pg0Xdtfu*U;T6Q5
zR&(Cs$lg%tC+$isx$6`hkGeD^Fw+-i+2
z`;2B9=*mK$01kz5S@9r`GL&W-Z!DJnZuVkgWr&r^%^*H-vEX`Y0o+tcHz02${^d!Y
zqK&P6!s=cH=yR#4cP34ebSo)%Jc+v4MXoCcgu?63T@ENYh^>;hmiL-?i;qA^lN#)Z
zUVMu`p;4^LXLHby{lN99m|$k_@0S^eF-z6jQ~~E!_W6wKvMa3}T+JOZ(vfM5HzR0W
z=dQI+I6{{`4j#QI)0&sEsx$gpXi8NoDdm3fDjL+F-*Hrc-=4D+*`w<0UmA+gIBm#N
ztYg1s&s_mwoqi1emUPWyt#~~sV(LOt?(~DU!`IF7#+9ABDs;$_Y#EI0gn+aI!Xks~
z^0b-;ur^R>`DM~+gPYGbl>aLYz}aqIvYwAiYij*p6qGIN%_8
z`yNvTY69OsCSi#aM=pE1>UDbF*@b#Mfx@hMwvVdRO>gxz6g0ltM!!3u`fCFR%s91~
zKqs>qJTFaF8qgxdUtn)BxqKAgHVrIh5tjFOm(V5Rk+>OOgN2x+Aqk0g922%hF!$uX
zP&s5@`!@d0zSsAtUY})U
z11AXg=1zIW$d@OpRekEwHU);P8k3u4?&Q-3(F$$8L0k-Ppjbh7_34bIZ+r!Aixv#*
z6agk*qW0|V;oJOeVi+U%FWv002y>s!R!d<`IMUmM%M~Y!r=tx)I7YV*dvs08bb?yH
zMC?h+O{m(zl3(+vQS$ePg4EB=*c;T)w@rCXGR{dBJ6(B7+w(`e(mM5OyiiCttC}Py
zbzWcDlFg-JHq^ASuU2q417~_)8mCE#A+rw5)EuxQvk3%!-OhBu#X~_e8JT=eZ@z@Q
zsjE5)O5BYm2^4tFz(r-avZ7b#_hpLHtwjSdkF^S!Fw-=aWag`Ng~``gtt?PcRwvRQ
z*_qVknVh~SF}@^pr!-zK@>v^ONcLS{j%10
zaKN{gH*oZ|Up4+-YOc7bW3x0*GdP1Bb&UtsZ0Op3b9?OjqtnzeacFw<#aXG`VScX`
z-z7;Gwc|CX;X=%LZ=W!C(f+QIng)cr%pQ)$P@5}`M90{SxjDkzyN+dZ&#Y4v+yCIR
zc2Qbhlt9?_2WYX2{JV%qjT%Tg!=rudh{<;4Mqn`-
ze?`nlE^%EkmFspEVZG74{Ja*}gh7l@GS+Ebqxtk1p`^1@#c6M^JmOi+gSD#OOu=nz
zmv6ykPMFJzLQ?JQC-Hap#4=@Gy6Bc*)qj3%reO
z*o-~8d7v8oGm{Ou10#=la$7BiH-S6x50#V!)2X{wrCp09?QoY~k))?qX^lVo6mXJl
zOBP@0$~_;u0KVm)UC_GhS5BKp{Iu<1WyW!|eLH%Xe4BwUUneTJUR6rbih<&Vx{gC5
zN%i=i%fQM4kXgRTD5B%l&G9?ocj;l)cyM&RQkK>6a*#Im&Hy8TA((mP6{|ct5?L^$
zc-OWhiZBy*cYx#fwZY>rqtk+LVz?UdwJK|UVO<_E&kQbSHt$s{vOm^4dqRZ(N^$C6
zq~L?CQ#KhA@Yqhs+@Yb^3kpr8HaxCmw(ylDUFtEzg-6RdaS)?0mb+S2M=n
zKauWFnfxfUkpQ(wQTF!y$i>SM|3^FZ!tuq1Tv?eZ`dqv%cRT-lcXMBqz0b0~Cvx&N
zSR_0_x7kDa(Hg~4M%78JbU_UY>KKG!EmlmRx*V^uv*$&>fADl%yHd9!+=%*0qdM@9klEGu`~1ZC_30n5^1h(gYYxoVq$-U%Iq)cx6RqnW7g;0q;ip%
zyGXsTE|zcQJNCrkH1INX<$&vtXLRax09{Yzgk_Rwsj@bU@Vzz@r#x^JBuh`b6c$r=
zv)84u_cC!~Io23zKh+y9c2PANeH5a|Vc~G>oRooZrMn$H=h4MPyW7!_O5L}6odCj>
z&%wRiTa3>q1|lHVZxq=eP}>n>ot^
zZET{6>DC0P)NDe@_NTquhQ)WjQ7B7%e%79JBh{M33A^1#Vzb8t)>B(v#TVOAHHuvP
zgLzC`cFMGOMQ>tZyjJk)LV1~KF()%gnZSaQv6rd!exbWGr{gv2=FKk}2bJ;*akvf<
zgf`-tl%BEQ681~<>e`zB<_Az8q15{E)O8Nq$4l(f29l6VvrT+Bf$*8w%K$J78F~SxduQZ$kIo
zzV>cEucp~wWUXdLBK}=S%e&_Pw)_LJm#6~fvfC+}vHgtqH+h``O(`lL_E-v~tkHPr
zS#Nf--h}&l$uIBqUv%iFG13W9m9XS?Rkq#kL=wOhBt`*i;|*%0RJR8~m#kCscCv;v
zA6%^H=mLA2TMT;SW9$9XLpDvUo52Yb(d-7F?`uW8{HiN%sRj3)f74*()>+IB_id+1
zDhe##Fyh+e#!Z$PpYDAcXmrw70tE+0a-*8tcG_8hA^m-O@g|0QR3;A>P|l;~4fcJU
zd^)T_s-4sKI+jLtA7cwVL+w)djITtz*W_X0(YR75=6@-QVY1Bg@bf_*O}R-!rc>|N
zz`l{vTalTv$OQUrxv`%-CXWqiS4``#OCVo4+6iTBUJ4NP@3;wHZjadX%>kY*yWYhD
z&y1CE6Mk;5@H#r<;%=MMLtG6g+KFKk?C8S=REV+vTr>iX{Zo^9`(4~*Q;I*=$OUiO
zC$tYY#jq&}d@&k6ar6S#JVo_8O2aX^`?YUY#5bduL|hbD%8|pFxiXmBjh*_IN_D#)
zZELqIwSZ!~={hCS#wfa<_hv{R#^(2X;oQg<^F
zSoGF`Domcut`ag@pBZ1{+kf)uybzsQ%j%8tzU$KcPOT8V3A5#!d|n`3-6e7CAs0F+
za6L0tZSZbwXDJ14e5JtTooS8IHTwRgAMN8yU%{XENu}>*V^V}$%XfTBouQG+0{WdB
zF$NY}m6x><_cOtba7DNf-ZPGdcJmsNF{_#C4P
zO8cBQM}{Y4#x+-%X(uq9ZCl4b{nT)wR!UeSw0`Hy5T~>|2OCx!Yc(rgKIct`e^xc0
zUw`ZCE9Dzid-w4y?|T_ESY=kfDmBOXQigoR9JvN$prYqti=PW{9hlO
zD`LXUSyS-}=J+~?eZM4Hog#R5LsK$TH$5>Jsb6Cr#OGYR2U7)$KNOTjTKs5W1@%l6
zZb*haQ>8=;Rg$$#?4V^$8c3W3!a4_}1829)hgfLje{r#1Y)O@z>yv_&e^wn16sA+Z
z2}m}y9nyZbj-6Avn|qS6Tb&mvaR=@m-(Vh+vGFc&LZ;W7?
zFnHjKtIBs?+B^2mUb$#bn{wP;85oGJ5-!-a5pi)KN4boKVY*6{1^^?>fU
z!E2jzF#^ZFsD_9a4l&qto?4Q`X;9ReJd#mu;8uCQ<5ET$XW9X(TDpxXB$#jGNO`Jk
zL5x5RmArQWM4<%AD0j$Q;Pquw1lHc!P9W7GWob7g1S)RKdMSY`G-2r+-Zch$2x7`T
zj`Lcj`tdio^wm_B;st7g
ze&;tR4?J++m8z5eV?%a+HT6g}x@x>o2UZFS*3hB763QIPp=?&p-*^y^+jlXa6Th{v
z;+{&E)hC$I&VWD%zIn9Gdw;XI|Dxd
zY+Vm3Qze-+Qa*Vmz1LhoVs<7N~0_R|(h#tK56>LZ|yG;b#`E<%eqaj0e
z*t>v_ozx3pw#i;|-M)7Jpkswi?x*%ED_iT;NArF2Q@1qKFPEA!|tk$;OK4
zt>f2JNqDLJFel2I6p*SV*lKX=#_s!N2}-?(@mTX8_~dGv=w9j&E#AhLRX$;kKD<$(3A?MX4c8}{!fYyXgQytQPy9~MSy;eF1OZG`ce
zPqEf?*#L(ez%)Unb_t`Jlfl*csvkcvoR^s?YED%|=+aDz^K^#57Ci1(u()>Z;Sf&1Sc0=)I3z%6(7b69ue2HC=
zUJ}CyzxjpbQXzk63pkWSJ&*}T*3$2QI$j{l^9GPVW_;*{tizO(giP|n
zn0b`41ce_)XNQO1*yImzA1_@?kPQs(s%1wtK?Mx4X@+Az!;Cbn$Mo4Q-VTrZfcp7~
z&$d>1d`3VF+&|GA>~o%z;l8A>eM-5G{T#l1`y^vlo8FaZeNfeOI`6o3*pMM&Q`evC
zSFRb_K~h1Luj7Oj&@c)#Rrwl>&k%}f
zK#CjXi!VR%<#miYu2Z2mhf=2O>Q;6|Tx69=U#OkkZh{!HLKCi^GqovMiXu;Pa{LJWVn#?e%!R^hTc>AD>71wJt?&2crhEo=zM2|0mrw*SAYhoT5fKy8N
zIM?{nE1Tv!aV0he_?|6sZoH2H*kJxuyI&m^YiU7LOyjERjN`B42Sw63%Pu++!n
zEJ{#~LG6{($xwWw*H3By^A<-0kAjZ#6kmr^KYJ>uaF9@y)z4P*f#13k;$-~BKKna&
zzOv_0=fyc
z;_5g>ix_t_Vo%FotnTURBNNmrR&^9kzPfj$!H$T1zeFnl
zSE+0ECNh)51bfxr!HGey-Zz&?*rgH?Qe6luDg;{`&8wy6^1bEIldx#wkFhyaP@$T!
zD>u|;2wa^16i-ri5)^uPXt3Eu-QRSFv&ooqGcw&eU3a6c$^bL*IoEuS6VSFr^?dOY
z>Iz!2wZ6ISLU9{P+A^fic_4Gxv)~}ikWj)N_tJlx4rusli?&*oyBrYzF}H6=bLzNO
zTh4xnelQTeeb86oow~>4?^I0luEXiQ)R)OpadB?3z2Sh850<`2Op*^aBQfGaLjrRq#4UNSwSA8BXs1wETt@Q2gzXCFr#PJkh9=r_Fp!
zTt}wuC1&SyKLQcqkp#79i5gcQSZJ`L48TB^<>*_5d5SkZzmC04ZQ{gNKz54z+bbd&
z0IJU>i^8`Ld&(Bf+&Qb7mW+Dz89bDeMbjA9dCZ}5%;GuO{;(61j*@M3rJd1Q43
zjCQm;ZCb^JWn^k5_#;%RZzd{!ZJgbfy8@Ay&*~&=(I~V4y(A`RMh{#$_2<3XPd@c;
ztBe$r2ZRt|LMps}9`f;}1p>$X`t|IE?xhoU(H^(r(||#i@ChWJc0XEoY~kJhGvy~L
znb@p#an89Mc6tKKc?ctgL`3*b(yu8x$zP=!Trqp%J*LSFyP~v9PeR=#1Z?#NCCyDR
zp=2c*ziv~1!m{m%{-Y$wqMu{Aw{n_q=GPp&>ge5%PYzbg
zRqh{Y{o5pf%Y}awTF#yw!1VUt=C~t&=l4n+&~^QPHVyn^f;o3zQGm65bVq>DZ`5C-
zxzIBH?du*NXr3nN2`H;^-@9P`h3fb#>-AwTdLf6b#?wJQc1L(#Ja;U;Y^U^&Xt}{+
zgdyu*Uqhcj*J69n^~D3zB_{7p9O)9ppFI1oU(Y?HfX}jPp9JN!Z@XY?nTleVWib{z
zeH=D+Rcs2NT*kC|*xod$&18d0^?DVy=Ba{rd6nv*LjjsbZ`zZCHHb-{)pe?+$|Xs8
z5G`Mrb7cAm>o93xJF0;zLAqUN;TCMjh2IrB=NL6wAvWuje=PD)aKU{&)7w0E&j>BF
z@srbY^*KQPPm=V=Nt|d0vu5YN`Hs)N%O29d8`{B>z#J0s^0=>^Z)4{Q_=iK1DA?25
zj{wF^OKId}G)gfTM078HK;e?jhpbD`_fQ0OR||u{y(X`SFoV~0`hr@uBu?Pa5jy2)
z_LKd%S@
ztA!^;M@K*Tvd1{0f0s7=*0~w-+{$9PZFEAnj>)E5-ZLT#dqdfJ2vB
zIEy`Uis!5sTGnOQ3}9Aq6EJDrO){0Zx}8O2mNya8!MnF(J;ZFqtD4FmZ^TwnQOoy6
z$qsjPK|%#vs-0xUP$J`EphjiGMitvN)n08Q$z)c3Ii6U>^#WhJ8ZNXCY>YeH=$vVr
zUp#LD`$cW3jb>DJCjxA5kXT+V`MPH1asYzB(CroZPn~*RIy8Y=Z0u2iKX^(E^C+pd
z2hx9D2omup^w|nK-y8D!P678B@nv_^<)x;3mRT^B;tqWTc$~*3*z>j10Fef~;dpR6
z0V}DmR^nKB{IOOoWb$r?fd!_L9j*si_JPc@j6dX`gfceCad`G6vYVjC5y6a+OtBs2
z6Le$O0MBulh@OOfI1Se)R?M1KYec%zAL0RX!vCmZ*S)I_iMe@avFWGBADF7847&+^
zGp;t+DZyST*1@~|t3yL`o-rkJHH2I40sX0D2V_#^7iECE3|ZkZnZ>|cmS*eQpZqfN
zwrYIGUnFHBw5oL0^w$qCZ&Xt5QCodaq^HjBig8g9jOo4eq+BvK`_{J@vae|DNT`!=LjuBkrF=JLmd!s(`_l6|gFSKN$sjcFIgX>W?6c~#S
zRgR&HdV2)J5Z{fl$nAdlp2^hNz~@3;tIp=qot-WRedZmFzmiN;XI-#$@oEg({75bc{lF(!hdhF
zfVA*};r^d_)GljYu8Je}B+pj|cEr`IbK4{wC)Mxva(5E~qm(HEv?$(Iv6b1-fZBIY
z&9h#JZVYZQ1Jq6rLJY~3T%FU8S`Yr#C-Jvi)dSSrCGh6eGUwWnJEQii)g*TWbNI-5
z<^kQ&)4+StYv$1k-WOVI?!~jcEbMBBZeLv@`)`tf-3zT4=^|Uk`gaut>NONV!QFV_
zYa~u&AL8VJ&kt`%zD&-oZd6VF?3wi92VsOmo{A|dTX-u(|MTs?rWl~UuXTH
z_Y-=fK(}0xgKxKDTV|sFA9YHaYgpP<3JcLXXjRxrXDpvXyqR&#T9Sa$ULIe8CswN8
zj1XbOH$Sz{%5Znt{IhBZK+QHy
zwP!?P2P1-ln~3q%BM2wQ`hJ5)B2tnJ@jyl%YT7ImO(c2}s4X#8q*IAy*N{=2)}8yV
za4){d0)>)W3YW!@9Qge3DR9AZa5w0@OAszIwzMyF&9kKa@cI7DqLMig|MKt0ZfRV}
zjtFCDOAkiKiAE4w~>2<
zv8%cP8bp4(`gzl*r;Qqbp|iy9ib)TWG{N6uhiQD(T*{nSTsW=qCg=jq&y
zYkc3_7G8)RS6^@3m-jNV1)*4Fa$CH~#L0y62ks0)*Mo}&w?i$W6ex47rz)EqfJS>r
zfmq@`FGT;oIz8Yo0xA7Y@cp2v$x=2A{#7)b71T0#viZS{>!EV0St9sHucuu1wifua
zXX?xQ5Jd;Tuu0m|{>c&Ir9qJZb3trjeaEXvL+CUODpcqQv3KaC70x7a-3K@1QY*)?
zn%qFzLaPO~>Y2b7*Xen1>)+4qEJ@UN7_-!85O;T4@?IStD&V=P?p`Zgn)Yqu!{X?R
zEVh?Q3k-VY7V*AD^ws7hnf}fhZ0YE&=7CFWgV2~@d-$6bKD~0mofB>Lq|U!IAGo7)
zruw9CX)cKRz9
z>h`OA3t-^oI3a~zb^2$fg`GMkAS^iLkI#~hbqy&Z!FI?`F=y+AD
z*Mf@3z3#%GL`g9NMXtq%@j9B-WG#czGuEg3FGOgQh1bU$`n}OfN26fS{8;2)Lh^Nr
zRZeP9p@hJ@vqjNe!Rsjh35-tnZe6a+$l+$G)8Z9&&xB!?hG8Lt(~D`(?wIr&-^KKB
zT41(?RlCMHw2Jb(cSm#8jkPU$(}x}a359!nQz`+Gi9K0CxtYx~m#>CWIU3y$Ma3I{
zifa}P+>56lR%pNLpmk(7xyvdiyf?_wj*?)qFNwOD9=r+%;~2(i<*h6w&CKqxeW*lr
z1=rzn3rke5G>_faN}Ky^$3dm(KAvxV`u2XM+R&qhCf$d*od&tS?R?|$W^@G>EdO*0
z|JqzW>kL3-04T(Ag?1%fAfh1Zu$X)3K5(;Qb5ToQEya$G9+KnzH*
z?C!_$R=6n)qNI}qEULNml6YfDcjL`cl5=f(Ul9d59^LBJcxk4Ot{EGgWe@@z!fTUOP;BW^AR*;vSI>sccA(r}{{}(?OJdY#jq_
zO#%{LAiLh*XwP9ZDF`Gm=n)D?vr$Lup%%^sJL#Vp0q_@5*H}%Px`YK2|9d94zr?oo
zOUuaX6dOJaN=fWSi%fci^V_)%^XQ3rA~c!Gl|EjTG|QZhy>IkxQzHlJ+?@d3R)Ru>{JSYO#x?P4F@qkxs7$n1-o^U+V4zD_fS`qhM8FMmE+)MAs9)$NnYI+K0
z?9LvN6nUN>oa^VD#@wnM;@PAxsi|s171eM<5b(38j&r2vj8s8wW$JC4FmfHJWUep(
zIHv(`$q{z3dg=DD+4T``Zk^K?
zZnQ}&F0qXp3JL`!5_Fzz!1X(RdBa<|(Jp8+-089VPR`a0(KEd+K%};V!8zJUX9$5s
z_zp&!Cx(3otrSGb&P?_*ILJ>e#x09L!}&`SZj*i#6K4Lm1&rc+R}m2mWUydZ-z(&hHY>POl%#BG$FqED=jjObvyleR
zL681x7bhV5!z$`Hu|OTj<&<-#!iM)<6HB7n88}2^MOuGEu(ZxD4-AL8GeeSm*grQ&
zCvcaqECc=%ZWPU%tC!g&rOdi?d2!@34hU2}tv-X#;l5>D|W62i4f-6!1*_SCJf{nQfwcz_^K_md=hm6^Ya-v7u^1)7X{ed!Kn>Tfo?9fFCQeR*r;4t+xLmuB17Al5Brgu8|0H6HOini*9D=RUg~b}AXL)e
zx(}+Da!1TI&CWI0TcXh>FHCpiLRWZ$#kemx1+^Voyr(#2MiX=9xF5!b66O=r;OT!U
zN4$4(c>Hq-L`m+y#$_kUgy~&T|P(33_rj(
z#q9T8==PMSqF_w}#!B1V&2zg%5moB6VuUZ`Oaju|hk6*@92r@I7gqvAM~MK&i|Wm>
zo8|I0*WB31wn;}sXtqO78Gbb46gke%TnufF>p4HVzA5-Coc5&fEVgmys?6Ukdu_fx
z;Q5PSzW!L3c%E*Pv~Bi&jQBGpy8lyjj(BTVcyYPFLIWuFg3u>!x;BJ)
zJWvOYS|`QVY8+G;l?G5ihFOV@-bimaR&wE$^NOn3oS&*fF;D;Mi~jj-0yO_M{;wpD-YS9pNGr
z;o7M)t7E^P-p*#;wwmcmVmXs8GUA45C`DhlV
z#CPJqrkeNZ)$iC0a4mw8EEQ>?WT*IVA4IWU1O5(G&K@>@>EBQ83!nQp;O=?EzhOVX
z|K>DX;X>0sIuc1@8cn*%yhMaFy5vCvNM0{@Z9?M#1V1{Fpu_ayxAu*EpE0{LEdJtE
z+V0@+6pQ^dadi#ID~1TB_zv^V+=7F5_B$VFe;e}RyVK=>>%TQuVs-VmKHr##2+?m{
zp2*(^noe@I9t6<`@*KC*dSByp5U`2!T$)WGxFYA=n5ho(HPf8Cx(s2wrz#8^i
z1Ebi4mvRJ?J#oahXCt^g%%?TuVih`2JeY_0tRF7DvVX4Qo8eGD)S>ptdDEIQb5wJE
zbbZ?%u^O#f2&SCS){7`6U}O39t5xnsf<`&(!OLafjT3b#B0U%WB>arzI*Ve0
z;n^bhDCE~i=!s))$iT9F#KT8#tsA?l(D@LF4C6){{z>bL?+?tUmVCnL0kG8Jp%XMv
zQ=7#pxs2!lTX=n#M{xzlI(t;bjdY+?TEAXFqh%stPpbc>FU&n1C%6IVHqdSseR2E8
zIGf@Q>-}VK{QxVGGj?^0|Kk4}9(vq=Eyyru8+ucf`YDmTU$ST9jpA%`I+nMNE@BO)rqwZOU5mi(<{P%_bdD-NS?7*#XqMk7PzQ#XqkUamG@q~fM
zFu}hygAWBQ)j4NM1jcEk%ms+NvHdr>{b>`}|LCwL%5xdO
z&zVQ?$!SCNEXk#;)C^cp83eE==v4f{WG`MIcCLdb27ys^pG~;8U#-+89Z~rA&-UKm(vj1a
z8N>N|HhV%e+XTYa_jHXl%DAG=X)c)wvyCr}yk>rEZR
zVn6Uqm92l@Oacu>%b&!y6BFl?88>5Ynyf7g9Cwoh&iCLT-8~N)Ch~cW%6cj7LdXxk
zop}Ci{Y1_uY>Dm
z7mD)it&{X?whrrXw(r-7{9N@w*6GsGPaS6=Gni5Oovz;>59h
zipjawZxb9pIhN!Puk%grSCoK?(YeSgsqU@P!!e{uJ8Rr1KXKMJH*CH(V$$1q{n|dQ
zxB2^>&2w#h8z*`^`r3?z2Jh_Gy3vO;ii5O84x#Qo%kGJAS|PV7*n-A_18!^zza|Yi
zgdgd%e=_67trZ!_Su>j9h+gne;BNyIUD{#&O<6}qg~ETw_#gx6)PHr+4h~uN+d2^=
zAo~1wdOr-|HrOoIw-GLz=l%Ih>C}LuS+c8Z#7#0gT*bw`Q#g%f=Sbgo}|zzI(mfTjr;B)71`3YE@BLo#{Tk+9nMc
zneU)s=ibp*`-O}fW#Keiw!ey&@=w6YM9*<6a`61jt51;qIqz*ooQY8%zWzG=JB8qm
zmC|&m$YQGhaP|;k35CN0&ot#W$;f)_XOUAv23IDdJS(cctBAO{j2%ga#e+5~+^ndo
z@~hB;e$ystK8-s0?tVM!nasp`hS|m^KgGDT7Nl{VtZH3XvWfaVM?-Ua^suXU|JwD`
z)snZHIe&CvE;09?@HtdfZR7_o_=2(1Y@SE6#JJ?{r|CPh6Znif1;>2%O}mndNa>%-6A0H4x?LW3aH?b
zTj1E%-jB-x?)2OSHM6Pt?t>yWQ+f1RBW%&EXC$a_N
zCJ>Bm-Ns2RXb<|!8)A^l7^(0Q
z=M=vWT{qQ5%dTC{!zD9vUwC*#G>8^9Oy}xP)!E_1%;__cZV~#m5e&6fpnMNS4nem<+chYU}m-pqkL;o71?3Op==6{;8c?)^&38p@1
zJEzIKxgL&_iu9h5DD$%K<$){uOVF^p8C5mgvdo#AaI_$~2eNDuu5CQ9wZG47wwoqM
zq3US3^R)H+%(3bh-<~$5RF>mHa1v
zM~VDhsW-C{BPqiup(y0spIK8_wLyjoyU7Ct%SMeG9CV8?L-w|hi~Db)%nIGRmJ4DN
zFfzQj=0j{rMS}Y{%x{_nTW{-C^0k<>l3~P_*LZ!Z_-i#pd3RbDCq!?+7tRUzdDwS~AoF_cQI)Um&|i6_R_B;m;X5Wm
zJpS8gWq)D^`7&qHR7wKV=n$`H>-iGrj3}|GQI0ME(MhAdwf~Lqug6Dx?eq(*0p-NrahU`#be0~kncw6
ziQx*#KfKb4U6|Z=i>Yfm=LfBKCXL|}Ek8yntftPit?IkN*Ds!F_?FQ!?erqit)Tt2
z=emJrHJv4t-Ngvc(}5-4bxJ7YBchbFB`;$fN?MNR!UtE*66-Yf%YL{M9AE51t_p~P
zqoI3?A1reV4D+{E!_eZz%)S{4O`#{Zu6^1fI;YqYMj++9tc+KK2o079aAOaCUT9IJ
z&$Q_~YF-T4v)+4Gbp4N^EfG&jW8%fYskF}e&+;{$rFX429ybBH>9`_9QaZ!*%)6SJ
zF2;1xogY^MWEDFl%vClySrdi2Dnm-_jrp|`ywfwoh;e`0-(l8^ddBSQ{G;oPtLw8-
zr(UNTaM09O{L03T-_+7>y$t>SDXw|VxUBTh7}7>NuTu?UR0Gy1*NaICf{`0;H4?L#
z1sH0*^E&JHMQ_Vg(R%{dP^KQZ`g%NHYd8(@6wk)+c~WG6)pU&f$#%?fu}LZ&3((m>
zk$Sqn6g+`k6=678EgRmK{AEXQ8qIUR?mDPkyI6m>EDiatnHX*=H_!p1GEDnv%&P@O
z3B~brA|-QigA(NM+~HyT#{RC5XHr;Wd-5h8U*(=xCmu?DDS&Ots^m5|fUVU`gZDgZ
zp4Lp-S()&V$6tjkmTL54usr;6W>~pI;yJR9x6`=i+-ldRL)P;>CGYJ$^9asrBCHp9
zP`z=5Ub}vMPUs&_7gEo%%!FF2F
z?tz9BQd2fW;pyiklz>*ND-EZrQBwIfsgodN%~RyCKSYD44zGQ%$Gz`%#dWD)-_h|j
z$Uh>gb#&B2p$JrmBqBOmQ*1_PgR>i0)14E+l)NRF+8^~8OuAMv;)DCL%@p0{wek0L
z4ta*Ig8yZjh}UV3gWcX`xJq!lwod4hly$*%+}_U_%opq{=6uOeUu+yfQ$A_9(6Y1}
zL)Ve;a&TLk-XlG@cp`hWpl$gC|LQx`gg5S7QJ5?&1Pg}gHIPpe=g4|n-+RJmCsh*1
zQ&UZhJkd`^icnBW=ds2utBqBDUsy#?-4|FR-%FhFz2RWBYquudvyq;{g}xI59)>UdlufN7Jj|UG#Etm+9~&`gh-jZaXvbA{
z7ptMWdJ!y@jGCIv+qxldP{!pB0GOd?Y`vTj8~BuXcWQLuEQPd7KQ7&f#PI~#x7lKkg-%aGLmpTmJ_=PBJ
zd&0{&Vp2L{MIyRGpyXJ&bwlJW;N^cJz2cdqktPU@p`Hk~i+V}5>QQ{WOPO1o3B%iZ
zKvoxd{lWon5VI%SCy9lx
zLCoR>#B_)HA2AIvse0qPF*#{XmMn6i(#G$aZA+mP9Dn6$Z=^gC4+N9*M??=dWX@pbi*Jor>mC>fVfXAlV~hHefiIM*S8JpW!bQwMPGMTZ_pRCS(*swE_wyS&l1RQf18(oW^r#k
z?*khVnM>pb#v?jd-Ka?{F~b{k4JRho{~^cpP-DJVhm7jDl|FI)*|>}{>%BLT|JacK
zH?90XIdA@70t3zAgG4YS>XxDFzls}o65sz*y@-e2q8Mry&k_3&zwd(Q`fu4Z@pPb|
zQ}4fSCj=PYBN~77XUYI7E$yC-Kh6n1c6`gkAobF>Z4J3^3z4fq$@VLCivyl
z*w3NIIDU4cCTUxb_?Jqq6&ei0>Gz4S$bXviasUp$5udG;(ET+!8)PyalDius8Et>+
zVOzs}g0fNfnCewOK4esvgeI(UbKR#Q1p?mv=c$S*0}Lo{C&=9PzbDGuFmVe@x`40f
zi%pi2$+6K%(x4{dFJl9@{==fdsEaLZB|f7n=?`-EkMtCq2SftOFa3(L^fGkhn)dO6u+}n5PWVXc$LBCQ?r7H(E+FVtrU-D_hhEDXL_qOi6Vl;
z5zFL%%A(*cnCDM+1M@e|EQzHrFo_y_L>7XuqBP3x*_4!Mo3!d2L4$)c=U;bYs
z?10Ikk^7)wtBHP$U{LY+465@G`7>GHDiQ!P@~K~#yLq>tfrBjOjZVF?-&I)6^l8uF
zq$k6BGG`zmJv~q}GNLdJa}WqF9JlQD?2pN_Z+C%LjgE^F=`6S~ddsN3`XX__(w?g;
z(}*A)FeG2;8nr`YAOOHAnw!neTvTr@@T
zL=bHy_^?ixay9uXu);ba+;wpIZ2Wle^mN&uD^~`5b4pb`rkz5ci1psANq3H5I@#v5
zBA&;~$iJ>>URe;$M5F<|`~OA5d!RNqPy1uDYu*!qURiK(6K+iy0Cw;HVH@^TFop>2
zEhhUpL@}cq>3_D4JZ?Z@eCVF2A2eI|POltM>~Y734-0$`9o6?|J6)FN)a<|^2u?!!NyA$G
zVlWSm#{bk%xF>1=0K|hc7_wEu=g;uYy!4d0jM6$FN+K&Y@bjPbvMBps#}tfb*s1=x
znK{8KI6x@T7^K0hETRO0_oG@Fy<#vdR%PK{QEXtyouVUfYl+DJhlT%IS3!=c
zd8Yj}x0*HL*CG+m(7#qq6I)S!N!6K>Jpb(jb)P7IcxS{*C2-LWB|OP`$<%4dDwoUK
zsvu5u^F~&IR5ITT=h(==TI0v(;EE9;5m+Wcz_MfM3>Z!d{V#>e696P^rarCLa)`E0
z!%e0h?WOm|=EbN(YHf4(%G^zx4SC#ehs72qn#A^WrdOA+93_kpg)b1lp}b7`E61JR
z=X?EuLrIZq-kCAHLDaySw@3Jt%~&K)lXjoTPG|L@e!k6PoDs^s`};cl!RZ%g<66f?
zfj*Qd;umg?Z~p(G>^%dT-j?p+APP1_MWus)h$uz6)aXG(sVWFaN1Al$C6M4jL8XZ_
z=_*a6_g)m~0@4DZBZL-0s0k2~ygNsIp8LP&KKI`DBcIs6$?Ta~Yu3z0N6ziLixgLS
z_i4jL>YcGya+x1^89MiT-F92jE{w}8Rl^c+45>Dvi1kDIosA?!qZ1_;=jpfOSEK1|
zHW-4V)Sf|eFO_L{3!6?@anqBACAm+X8p!==LDN*Oosz9p;>Z0xZ|_ksN$6G8F!}Jq
z6&QXsdVZeeMp(<1?50!wqNKOca$|6VfF_c>!*d_CUQ+1RsId9t%00pWKa$M#@l%{U
zWn5eO%sE*d-t_mIa0lObMggs;zjT3^SHaDN^-^{9D?X9+>J#sq-3ZE&U08zB2)yoC
zzC-s2Lu
zjQ&juSB&-wU$#Q|-A8G@yxW=9oLy2vu}_C1Vn5nGTspYq6zh~`;X2r&zWt5tHdD^o
zRznC?SGMMlKDZn!zTBBnR{yZ@M%?kb8@G1J4IqzQ*Z$J0Sa6zpFFFrQxALi4^>VL@
z2j?gJz`KjYka`safHWm$egc*O?@`EM71zKkZoQ2$U6YuVGga53M6FblBJUG>Zrd5_
zn}^iGKj!4Pn$ke77yOJl#!}DA$A*(%Z>u|4V>(;$cB4jwb$Zj+!bTNg&K?%oR*cV9g~EI0d+6UuC&7vv1ZT#AawJdG3U
zU#h{q+>i1tIF03y><#6sb8>vW7ZI5rgr6)r)%jwuR%bYLXh5$Iy{yoc&wV+vJM8qC
z$~d40p;Mm>w6%JgL%E*qG~Ah|T64;{?NcZXLm>BBbwvN*$?9y!c;8dYL%PiAmHA6P
zZRa1=^ZK{eP@0kQF1+tC!Ia_eXD~#nEB5Lm(|V?;L&o7yZxuJMLxo9dj*RdmIz4rylvRFw>PFxJZdf#nn0CO*4d)=^_5~=NRG@c3YY_I^L!Vp)F{cdC9k}1*5+e|93VWR|N{o^A)
zUOZH3;?eL8f_f!kV6*TwV{lJ-vv~?0>ym0uxCEYZEqO6Tp`6>
zv?5+?xj7QOT{#)mMyDW3fZ}87)<)T}7G-u&$ruL4TMrnXP{{ob8-tsoD5A9Qo}-<;
z{c=g;WNK#(r%C0LF6rI2+@Q=)a$EF$Y<@kIM|QB@u}0FSl;B9&LpZEW5nG>DE>Hjy
zDhqL$WLF+jwii~#e4yA@B{upw#n*gGtZbk3mN6F=oDl47*!LqgT$v#*eNgnI$S&q<
zDL#cJNDt^mcJJKLL2Dyj2QBl7S?FEaTYL2!vUomX?Yl0Ft>@ws1(KqB+T(?HzNQ(F
zkwkL#d+`;N(neD$ExOpjm5GM$s?w?xx$t)PnBCcX}zDt)y{i4$SR^kvklQE
zeUm}RL7i$lw0X6s)yqNAk_tuCM8OYd`Lb21pmSYshWFah&N$mz>c_KLeb%XL|MrsGRF-@`wl=Npq!JXOCG2majJ52(oU%
z)>}<~D42P&`$3^vKi(J5O59A)wRaMD>bFD&X~qfXuOg}UR
zuIKBao$9s+k3iw4c?V*wXq_m=p;=k$(qM8TfsfG&?!BM?O$Ilq0z@QAgQm+S13)FlPW)>wG9Hv-F
z@3G8Xah2M`=k=9uqtiPER_qK{$M|lIDLS3apK8*ltBlX5S$dWuv4Zw65w`4mW9^Cy
z`NXr1e1pZi$z_z%wXW7ZR($N4@;+UuDDo-Y#~PE&@jVU6OWOt6o?e*zDqMN?N+9#b
z%63el9(;mpb(y>*wvAM2wop8=dKFm{Kwzm}EU9r}%fl4I5&JiD3X0*{2HPH8!=^)q
z5za=+76geWP;C>Wut2J12HL^Ef3E!=QPJZhHLMSOFD*RoZ~H8)B<1oU2F?M2>I4^^
zhPi5>5OW3AS-Il+bnNWI4)GPqX&iclU?a
z-XKp(^McCijWMBJUu1=p=U~xBR?$pyij%(g(W4Vh!LPs>?#1lM1m{x0O
zinjZWm>FKuf2(9PZNn>m&M0tKZv5O+Tw$E|-ezH~%5K-(c8sCK>N+>8K3k%QC-8DE
z?|}U6DzGE1R?)mGOAU8vo2@F({p7@vO5@6cvwA2Q&DZ@0movwdT0W^}T$ff@dmu;O
z#O(bHKN?M}F|rzr`)&kd_ts!I)Y*cxl`Wbj-jm!o$6D1cyGnIu_uuZ!pa4-aHRjD+
zAP=&<%4%_eYkQdlq;UAG9?Idwr}`!Y4q~NoC=5r!2*)vE7f@HW!+)ZS+!>2}L37WA
zqx94QK#_!
zo&zPycn@LikZ7c7(@QHgOZLxsY%Lxt6ZoU;Rg&Y!=@K5!we!Tg`mG(ZCrXFl_BCze6$n8^Bk|6
zge(`Y(t&U^qz0Ghw-;$(o+z#G{XCu}OnjcgWije{e$=sI+sbgm69v3bZ
z`HkGnjUO}eZg&*?=$7?-mZX4vUrg*0a(LLd{c3O5;44rL&U+5>++4t^`Mgl7ni6)K
zk)PQHl}VuS|J0k)U^j(|K1=g=4+B4P=6%xgc@%jzG;CAnN2PZBe8~>%04>-Xdh##u
zYRtgsph<&iG~H=R#ihsu><{CKqPDoApa&)*hLDxu!Yt6(^3KPXq{#S2k3Yd;v5G#P
zBTJZq-4sRRQW1wwW>s0(PtK3!z58#;na)Fg1+31G_X2R9q9#iQXSr`Oy$lJs?4R<*dF?
zI8}xs4`aizr*p_`T#THuxAY2)rnq>o7{;$XF&zq=G}79E;S}N%gXq!qjIG{m=jyVV
zs1C3h{7z(Y$pTkg-5_cs0R
z;rl+Ax0idJe<)d^-*&gB?@vA0h%J_sXOT0&gi`*xSBnmQ-u`~i%$b1DGVP0
zvwb=~Milj8HB7}1dd7Q)#Br^+dJqGEBp)vX-)U$>)q70ru09!_oiZ70Fz#5kfhF}F
zFlPw!G@A%`67pFuJKTt$#0}3ODFRqy`U}>a;<~x4n0$h^&P#cbCv`?yz#+1)kvwY+
zJ8Z5p-1k25EQ7sgwH196n_e&@O}?T=dE2MjJi0W{#)T72$+$;qzj|ZZetN4|~*B`a=FN
zdlssN>(({Loh8*eWhNufA&Z!a;%D_l$9#9p>tgZciw=pkras^8KXv&zq;1f3HQ|fO
zB%)~V2dq9puuA!vkL-UheL-J%1T*9OF+{V>?>VltTzlB#C`_0wuCpoW7E5rT-u}>)
z4f69#ehWuCj3$dsd1;E)OOGR{Q_Ql@f8(g81JfjTAmr}VHQY~;uwFPj+#Yd!`T2?=
zxs902cQ)xFCQI_+<4e2sxa2oXtzF8D3g*U8&QxM^DY_No@;W;#oVsR+3VCvjV@a22q5*s~C$-9=-mtjUCteth-%
za6J$y1oeV$A6*{XS}LN4A75jLOvAwqk-`NfwDU^!TuwMF=F^z(S}Ki~Iq2N_BNLz%
zO4$xh<*6#Wsw=*7U$?4lDZ1mfG`XX&hZrhNGrHZkW)vTJ4w5?>y7T9zNc2LQpL!~m
z5^NmM;)1QgtoNt(Iqw22=l2WC-Sjz`vl!q>Sul-}CvO#P)lhg6#N8t}3+x$n7!+N0
zXGvZ~*@|~PS+VFGo_F{^!$CW38@C!W8NgjW}HO0#Q-o|4B-(KpJY
zoN@n!0KAgYI)QoRoi1n@)_j!PD)CN}(j{X#2_9^nD2713Ar)m?PUnYRgb&0gfa@7+
z>sFjx{oXITzP1iai^&8$XXN09o^AFNNX3>MoS-;0n-Saz+pldawNCGmZDIRf14y)LFKDqt=#
zDUTp3Qa%YIJXA)9$}^%lxaty@ABFTVdn+6p30m!X?#!tRtL5<+S=8y-el{Wn_O2F~
za;Ei`_H5icVD3`?>K3M^_qOSzgd0XPva{+((KPbC9m$}2m}KnCeJNT^K5kv75bU}h
z$SUq9j+!Fnd`rIWtuP%8%|ry-T8*LdVb
zb`r#PG%~Ga#_f|+kDN#=Kb7x(hW8OCyhE4NX7zU>*@}a>;!5jpr!aw^X9M9W)Z1a3N{D3jz!-
z?}DwaVN%M%p%A8XgDSGNwMoO?wj>dZ*Cr*d2W|IwWlK)$q8?{07iQ6iP%0Q<@g{(K
z_~5cNdGf+71tN7W8x{VG*#*YM)y*-terJ+5S|5q-IThN|K+hE`-E77uaDe8C4Xh;-
zdd%an$$+#3%7ebi{$YaM;exMAFKM1sjWT(+ZY`OxaRvS8Pct2Cz@{Y=En#D(S(+*K
z6rSMPaVMFnAKzYv2||#!YB7jy2O=pp-b5r#z73lEH*&uE1v`WwS*D+lzXV_2jkg+J
z-MRJj=@#J3G`e?}uqtEjk3TuQ?zbal66Bwo`0-Mu|JNV=Ch^bHJXsgCWuw(zaqM91
zagQ+Yh!7#EshRqqe1{be2TGVRv~O%~ri=NEnnA=bniLFP&uq9vqM)xO$
z`me2L;4Q*or}rE!Io)7mVCB_yo=uSKvgY@NVqCp7Uh^)P^uE6zcbx5VkU(LqpIj#O
zD=z%*`e^z=>IkU~twl`T(k*?pYgR@{G09#Pn+33w5ZlPT{XyW+S{IX!&=l3UHq&Jf
zt|~*uQB$UfdY!R3cb7CJ?AXhNhs!N3E!ZyHSY>a5{l)u`WI}Je)t5HzuJK-_XcCby
zX8rtU5%VAWKbrOsV|_iF1cC{6K6J*Dp
z;Fxu=sh;w^OR$^>_AG3Vmm)44V-|X1pP~Tw?h^LeWlr^Okl>e-dsb?cJyGi|uhR{r
zC%KQ)e2!UcmeXzeFGzk&hS7F9-nBK&;r|h-Rv&EO8LxvyjFu7M#q2
z8U@SqRYm1$3#v_DftJu9b^@bu=lFr?mCe}r&1A(TrK}AJl*W-jsqaL;q08BGt2ZEy
zcw%;%Nb{uH>XR{11!z(I{`MhEN=}sT{8D3uC}O&a#`aUfQEkSVwI&0z%JT9%4h|0S
zwzuj3y6CDmZ+?^dnSu@lZUM+Ow@tiAy|Hm+4w>W}H|9c2!7>b+2*exj3}}sU%RYKm>b3Eg
z=c^z6PyItpHHiO@$CmNtOtYna-%l=Fx@Aj5L6;0{n{U~ELL5DMbnZ{?wD>dS@y0%n
zPe)Q?ujRv+ETYvXA-T#^eqE^auVS(6UG4~o#mj)g-cMs64Zb&U9V7w%@4$z`?*Zf&5)0_{u
zDNir^*GS^|u{9#QG?f?6IM~#t=IwD*N(_!s+HaSA1(vVN589>B7M^gM&xo(}o3cB8
z_k%B`o*?Ux9dVO(dK)wBtLlJ*gN8p)v_%DX_vyu?BT+)XcdK_c~a76`kawe4Xcl;Wxt!y8O9GpO6ANj6O)wE
zvlJ_3NS^0bS4Xsf_00YuH`_wfR&l2F&rk|VL?&U;J$ai^u)(xk4ViCp1-x9+lRWqn
zr2oeVgY|-p-+wS6n0$QDCFSA}Sccs^U{hfv?^foE61o>@CUkjk8&_gV8eHlb-vV2M
zSkk%^EXPe1CilnKQ|_N`1{OXNSnEf0s=Q-llvK)(n6rm)^t6Vvqn|&eydKb!9WrR(
zR(~UTri|Or$S8W_n-kN2=?%{GP4w|X*wb2c7VDseuN<8vXT;!IQvLuBC3(+opr-NM
zCetf-JiMkhLPRjDHAL;7C%h(lVn4(+X}t;{&g?Ukx1FK*#4AAp
zRV$xeqo?ST^ZsvsbcrwGkEPW2U)ve2XtYB36uC8kQV|
z;eG&IuZ)(fizwjyXDfcJ7sE-(Z}v+c?H-lggk^gQ>R>j}{h3~C@|JrZySu$27|As1
zn4H+=zmq&*^&tNJi3V|bTwM{nT+g-ViM50
z#=koo>AmGFx)6qg7wWM1Q$d{!ePbV)49iaDh3wsK1&NjvkB<5tZmNLb;!8ld~b^F
zxU-PUUbjoi>3z$~qHzbC`U0eIXKh2*`@nE3x+2L%%vqGnw)^c;%xNfFPwi72YKrny
zS66pL5x!mhWpZPPnq6?$r$qnT%XO$}J55xYF8T;De;{K%f95ZF%%2I-;1P>WTm6Kt
z_S5X=;HxW|RuS;}(W(LmR3Q_L&aQ;&yrJhrB%Niz8P_dFZ1ag4{I>plp+{EmVT8!~A*hmeYs4;CG9&cgpOoIVSBftB
zrNLfwnrvq4{NjecB`fO3DmwxPuK#6j#AsCm1_+_t<1`q7%g#n0VG17$2hr32EuR0<
zwr|gRe>5;6VPYv$Q()$ISvfbMk#
zQjn}L#GG^gUSP>SE-
zz}mK{G~d>$34=*@eeR!E-&*@fAi{TBsIXH*dBJMn$mQC3b-5yGY9@s=9L>_Pn$
zvjg^shla{SB_`OHOnT=
zx6IB)D$f5r>14TkHaO`bLAFUnMFoplwj~Bh^f(d#pmRuGHPqK%hVMidzL2azh-`w;r4&&oU4bL(v_};ys=o_Ybl)j{D
zjHM@%QB@iWfQhSin`=LnolyXOsXXH-mvOMyRZ2=W(@Nm~@T2GexLz*@PiZGuBg-?G
z^WOi5K}V&F3Rq7Kn~Lv9Lf}g+2(PX-t^i%jYJORUNz)tRKi%~7SsG_1#
zqu#tZJ?k~=Y7KADQS+~pa5VU4QGJ&4sYTzP&o@@4$Rg>t!aTArru`q~-RG3F=i-jH
z-|P0W&TMVu$2?R%r{>xH2di``()5G>=-r2REgOH1_J4g_^FO|&d>y8E?NM227W9+p
zZhUc_W0BVgtjF}`t)LK4PO}V0f^6jI#sfiGrX1I>w*8QB65=vZQ*KmWnYKD*Haa?*
z+%I8&8RA;IUgfxSKRaf`alGh#Ks^H{1=<@KNQUkwnVH#&!g?M;W2jveEw{h1
zA3t@dZ&x-;ANQCiNFv^cvA-3FewC!MykV_7c`!lJt0>HSM*>)i608C+m1
zs}GXZR;{HWpl8y95diDQ;QhHycLcH473DKgU+aKF95BcHQSMy`zG|oA*%2+l;=akc
znh3hx^>@mM+OeF1qw_qb|HmcyXLtyLEuSj8@}20AEDr|#9~L-3Ma0D~IYSA&b|O=l
z6&0(|2+rtw0`##EAJ?!(;z~>m$hblJY0C1JqaL=}HIaZNc??*R(PLX5j)_Q$a7RWe
zY`vD0!I*`3Uk70bG{J!9^nrQMS|jJ;;p(-z%@o1DzTVCWt=&{NTl@dZ;{UAt^%8}^
z5qV-UTQ#IMW?6@w?5(;`V8k*C*#yMSDOAuR2M6brSlAp=^qf3@Ca|NqA~r?`y{QtK
zTz~sS7S`%R!fD7AfK8^V{Od%>KaOQ*oIKdX3xHiKwlzHsQbpkQLt*w8>1|u2GTcGR
zC3j
zVl3IEleY75QC*2iNJWocC3z?qtgC#5Pn-J;aVRVA#-}K&L#j~SnKbk87?94
z|D&ST*GjcN&fh!%NA9|b3+=y%2W9I04H7qd*EcKnM$_4q8y<;XE0P7c;rZ5E*SR`3m{aAGUHzNz5H(>v>wD*!aYJP=6I#Wy@eU=+04(MqI2rPwv(o!`PAd&
z$|JQfGtKw$81`=TPSG4a)Ju(8sCMXtz{uND!<}EAA4@T$53(C8t^*uy2SekYr<$VM
z+zXxAuVPqrNw9XRQ&?uw%2?EtfMrl*N`@F%%?5`9Pna!8kq0&QZ1-mu4@1fdj&gmK
zJZrMy)7Un*u1f6aZUlqi{+^w4f<2=h0>3=t(Zwo!D6QKre`Ab`|15h$z-*>#t9bFk
z@_%rbwJ)M!pRKC8(eJ-Ei^6bA4nm?jifjAOl*BfhsWdL}xS3%SeY1s_w_JwZW*;4BxG4c}ojJH*e(Q2e(b_9+Ak_fEq7(cGj({Xmdzp4cw07Je
zt^+zn5wOiS|6Sa^J#rdiDgN(t`c%N^KVV~db*X0dN1AHD{3FR%+VW!tHW!z(U)aBiT&@(yJDv)SIZL;-tbcG{lFuG`XmuzQ}Ql~BR1
zjtx&eEG#U%(Xx=%_0TriPDr2hdCB&+ii&@D;{?zD81ptHtYh#WQsa#tZE7@am)<7_
zQzxCujcA@2DF=zY^>8w-?tIwKO|Kd$6&G)JF3l}#us300P)^#@vW>m#&Y-0OQkFkE
z#F#PA;giGZ`#~3UeESB?KLPNWotZ}iCH+S^a@S>abuCFy0lZ0tIl3fsSvUBY>qs~2_t9S7$Oye%RW
zydD{CZ}ca_@)*M7X>ncHhEaCMjCQuXR75x@nN0NVw&pkQu(Ort&yEBKWY!H
z#x+lIEytYX$ilY1fmBIw!`Gg=l6(eDn=r_HiJnlKf@xigRhtWEMQvX?B
zd=svm3judoB
zSxj|vKu{<7eo6dKBfpg|Ff!)%Ca>PGyne2`joat5foa7ji+6U=0c=KJSJ<{@2$&sc
zXJTx)L_tF-`j#eqC=9XzUy~(X3s!ynhhK-jiD-kcIey7ul5JIJCe3L|X#zOlAhQYlQ93B~?+7lgOkVY&fns_Vxxwq2M!
zwgcFIDXmBwkwZ-qS(-A=5?uO1W~(u8>VNVbZR2-g^`>6y<*iSI0OHRP(>X95dko*%
zJxu8{XfptJv*M><>tA;aMzLUi#jR27ouhI2=)*5SFCzYVq7wf`n!DFdvBJ6jOxhl;
z<->{c)gad%y?%O{Cswy2{iY0TewNP{xCii$?tmX7(ahLdNZ_!$AcWkNP6`_fYYQOa
zWi!93-n$o7ob03EwenU+?RR!YVewJ|D;ECRq#o8*b0IEwVF;2WhPAEfeg^TGS9O>Z
zSTMEEGgJ64&b~9(5nWQ*OENjo$rMXW;oo;%j21NM>^#UAu>Z1b_wd2xR?XLMaA^)g
zxwWf19laSXswX+Y()PaUOt4ES2qQOPrOt6l{gm6xx#}@Z-xJZ
zv+G4*M^OA3j^&-VpC$4%*TlqXb>Zq%LEC*Z=mdgu?kbYr6w!>j@5cj)=-FX}O2)BA
zg0ezOu%o3cAN-t2b`B2F%&FXug|49H0ovc6N|OSJ4w@o9B*+iKK>?VLtoZNLll^|?<5vvyCwrK
zAv46bRCdhVqftFTL-VE6r03*WB^{%Aa_7!V!1V0^=q4I+g40c{)A=Vxw#1_*fPLq|
ze8Wsea7-3SqjKqRU}JK$_zj1@
zj-0;vJ&lP7-xV99HRr6UCUBF@$MqDbRg=~ol=iRi$Q3OWRyYjoDW1uIlIT{)pEiA01
z`6Jy|KY=Ia^6&Ce#-S#)C7je1=r@=GwzDq64;bSj`&CJ~M%XaqDIpUE>Jz4*qCx6hX{Q4RE^+iV59~UCQ53!AE
zk0)>0Q`3_!z!S84Phn*Hak%&eNULMtzbOZ#a%k3g90C|FSEjkY2Ytbcw16A&YZ8~d
zO*~V|26q@ylKc5-N?isvcUKW^fu-Bu0>SBRw9+hupn&~NUW$3cp)vM?3MM_ORtL06
z1;yi5Z^LPxZie-Yi49xoxW}mvr|N3&#p_|ZULQaYKtL~$ED6rNQTu$9gL46FM<%Y@zsp0GR@NI
z@>pc$gn#HnsLZ{?fnrPy%f5{lj|A#ig2#OC_7bH)KjdFT8^!3vb5X)=H{+0@8Wr#p
z$K}s&?3+f>ciwbHiENY#^Jcr8-o;^VHWbU17)8n-I*@Vl7f}J^0C{H+L=U^-&ZQG*
zL|re-Gp{bnHDxd3eRn&NF|1x;I3e6}9_>31pXD}-V@~$A
zMRG>-sYbMa**!M*A5fP{}CWTSkoaj7>p0H0!jq-xWKGDC@+zri$l=L`
zSqGJKT<1_Dm)x3`ns*u>qQ?_uwI`o({dN|r#$_M%z^(4mx`n(6p0s<VGH9`nI#zqj6{7JsVHH8hf^T
zm9FU(U3OMUt-~ik2|eky$HeQuSp+=?`PhKZk-gCqwM<0icdOJPM=)k9(e*Bk;P3{r
z!@e=Iw%fWPj{5oczlu5HOxVd%%Cq*YTT#6jm5YO~j-y03D(iU(xYN5%FWXgAc&8>V
zZJ4ER^^>5;SIPFm?tSN?*z-O23^7WL+EzO>Q8~!oKr{pISY)W=h3{#Piym-K+#;W{
zJ#hWi??(4^uo#xS`#mEEs5tt*mpiZcpvZib-h-3mpv{csp&M>>PfC*=?OfF~j$^y)
zF!7CI&H`t-OkW#7&Pg6@BKs`%BBY%KxZ1+Furd9LfKaMIfw$L3VS~DG?-e_mH36oJ
z*I=(X%Gx$wp}Wu<>Y`3l!T5vlA{R5+zVNoQ7ykGa(KvM0>&&97&p;ZtI}gq(wTdq;
zY+fAGRrtSRLPkV${`(@&mQztnp1gdYZj$Xt8E}uvc5EhZ<~ZAc!+okx#-`#&wN3y)d#=GTYOBKEyzPY6QT(8Z|i^;6&}`&7y#?sp;;3xtQkGw7<4@(pX|{&
zs5Lggh35`u#|fQM_(?>Gk+P`w1XP>I^WV!N`xG|IO05AH0R)N7<-h#spZq3B4w}@d
zo>3#XRny>;KUXLky@&h`%Mpy)k9~fBa=H#^?Az~yXzE~B+Fp~+yLsZJzX21Q$nKI`
zRIT?bV>4bii>P)%b``REjA_kY@&wLK)WiWbWq=v4yfQdI$S3he=c$(~WqXggM%Aot
z4;y!$M3e+4L+OjHHRL<#Uw&nn&0X&zKba|Tr1or@UX#(D%HP=T~~rPa51MG!n8cCWRjWymY#wA9DhXY2n+
zTA80;umyt2{p`=;xt)IX|DNmz3ka^a-W_;k(h%|dkKqoawc7|y)KlV3u2EsPF|VjA
z6|eT+-JPQdF0#$lkP97D$N|cW3AOsnq5Br9ALDWA$lir}$nAS+eYJZZ+gC3}Wu4jT
zXGko~n{_pf+N3*w=r=iPPV=O~&1y*;<-0p%#{f5R5cgQLWj5g3PN^b^*myyzDcQ*O4_|T!lna0o
zq-(D`zSSEO30@GL2)e&BWMR4cmhB()QW|@^C_}+xw?tz8v{MGK?5~ys>;RZ)E;&Yl#8ZB(5rNa1Z1Ik$T!s=ZR?
z#lDL}_tSzs#Mu|g4R_}H^Lb^Q8MpgM4%O}KL=~liv%4Qmtv1CldvOUtZ|FKDF$>SQ
z_!Lh-a+-d(G8h9r+q)g#q0LitmDcqwPbQsEH}iX-RZ%m0)EW@UkHyzv{w~jwVfaY7p_%tk=y`S-
zgT@G*>pvr%M&y_tXLL4KheWXI`X`#9rtGN-Sg`%2;Q?B6hSk08fXS-JzB(}Mik(aa
z|KQckEJST=EU`~UODzj?#slV
zJm4vkRGllObYZa{ww0|%{9u2Uf4k25fWvQMbo4S%6oGBJVRk|2p62ikPpnvij;C>}
zo@B?n4Vzs|0h8Ml{#>=IQLb@G^#iS`?-wbb88EUh3H%Zr(dW-p!(^Pll@)YVx|20N2R%t2OUgqN8iHB>7
zb_aly`?AxrmWPu>)U`-Y74tl^l!2~ClstQA7XM?NDqClo@VQu)^G!p>2=vW?LdZPzIf^{nt^%!or^5+%TaC1y81?Kqo%4$q%hG0;Ez5o^8rJ^(8Jugp;FJlJG1wC25E8(On1wCVtdr{@_~
z^#TLy{XYhV!OwM8LAT>+Xz4mFy|>;>l5Dz`W%-g#8)C&B+W*KYczCJVCb)(^R-66u
zG5eKxFRCa;aX6?uzXba@*Wa^BGi#`#;{~nLM*pPrZr5tGo9fb?YMWfTashM_`%Ut&
z)ckdQQsc3kJ>wTZIVgb6dK2wN>51OZ*uBH5+jr42cht(%Boh=doC)*4-B!-&=n9v<^V-KN2F~vVh!J!4O}>B>P5)J=2WOTrd#|9~#mUmH_&*
zuLgK@d@HsE12k)kF>^pwli(~(-{ed2@2C=P1m&B5w`jqejx>!opFRzSMd=wDUZx5=
zxok%BgYXdKT6Kl=_UteEylra_jE5t=vDvLx1>a=D7ml+^Y)Qx$xpnbCwDwu3b1o&G
z*6GFHH15M<$s3(X;lz`7aNI|$PD8vszqGeZ97Q19Rx=;23oWJoKPdf1N*cCVei+^L
zvF?bt-HJJDrD+J<`Srec-f*w$HDUQm<>CS+K6)QZ*$2D<-C+)9?6@Vg|Adr$9XnDeHovh_MR^f^Q}xS
zs*vrbT0|&EPXx^a_e6HJKhgxQfBzkLJN+QsP-hY@*2XZBBP!i2|20XQq*)O_^ss~^
zX;E9Eox|BSEd5s3fiDyBSP5rQQ-o_vFB3Wa=r8+@8WBeUku;vlT?#@mCD|R_09%b^
zgtA--4@Zj5pDA|1nNoW`V;I-HoT*sAM;p^oFlOS@OWEipvi7aAYS}G?LaSfW-GRci
z>7|m;!r13Jp*1n@dp$L`e7{tmh6u2ow;3RdzAcemg|h6BmloOq>nBHgA81%tbBC+W
zHqbT2VBQ|00H)ri5HC&@6y&Cb=QwIa{xjzgXjZ{->`)=!ClzwFcE*%*6sV#KCjYk(
zzqy!6OcSEmK5c*aoLArRY_(@?JFPWu@9J6B9}4RFw6mV7$}}4A!F(MwWQFPP5AcaRJP8r#aVe~w1Y(N6WcwEo
zZ#z3ZN@XE>Sw`r@iiI{1h6~BNu^W|*CtiCx412L5d1KFp4F8Pc?m+<%!K$I=A^
z?f=}3*tt=Q+%GC}|42mSot5=WZ-1`BJA5{D3nkc(h-|-t)NUc=Kju+O+s8S~n)UPei03DdSn_Jx>vMuzK}Xit5tBGGX2
zN`*3ABM;vcJCBZlb}{WjzEQ;pV`=ZfSCvlDp`uk+d4kx=d4CoIHo<+V>-K)Zx%vmD
z&w;7g;$%|LW;l_h+v+%XvYI97bD)yG-^7p0vo)7#o`jh7O!DZPdesB$KX~4h)>jAh
z*7P5%fWK7J(8nLMXC_05H^E{Tk4UDi8!WZ?xMy(H)R9>Y$YIED=&Q~+Jr9=ctR!O4
zYlC+Ey7wo$60!4iC2;zE#i^!YcLup;9Q$Uq#DAD%@N4k4CRee9901O{1{$h{6
z6|dzsd-*IdybW&Hdl{4GEL||G1{r?@MLY;ml*U?0mKGDTmKf_itJHu7B*+=XyhMjpwNlllU8K-M>4`c9dXR=y4Ik^4;R|HmpSStw0OS
z4*BO=q0!(#>gpo?;mMOn{{V6#U8U_XNqGG&ErYS|*JVx%7#U@P;zQC&G&Z<*zN-NW
z?dR9+W~0m=m#uk}S!xSD1oQht?uYnz!7h;J#?`F>haA@B%MWpmVx86RqU1-Utb_Sg>)mm2RN2biY^Q8xQqWWAxPN0kqulZJx9`(h
z&fWrJH6w}{6PEEW*eV=E9luO{8~SJdXiXXY@@^3UPh)!^@M&`o_tEj%t^~+yt6wc9
zsr+6r;B6)v3zmpA_r2jx7RZD)fGu6_K`S+QI%2t&gm6;0Gn8@~rLQ~30d`a^9{K%I
zIw3LjqFBV(Y{e!$|SZJ71f+!OVhJ4w5L
zBhTR@enMxK0}O!QzxaYMz2dg%wZQPdrwBV77@H33v^FXTp>ooLbyDLfFd)BZ_q#dr
z8dBAAf<}`VZ{I76IlxNj`SWeBlUBT<6hvB4231IfLLu$I0HuHT+@kklXCT@?HfUVe
z=E>g)*1ka!H0SU9PIrI=7a5}X4{@a0R9g>|Z;d7G5r1WE`%yz0@x
zwR5?>UaXizEvm$I21hMzLtLcuxg+HqC1+gle{0X|SPVtoeJ7LNlK?pxjy
z*!b*b88Be2eGE{e-&`6b8;oXfp2PcEdcxzjLfjI6YdJPCs$-OC*7low4hFJ>R-cXABi(YoE_o@~i
z>l3f{?bS&sGLSpJ5sHK~#LF%xCn|`qjfEDe;W;cdtUj=+*#AeN83c0p7h0PS23k##
zPUs`XK8Mjpjl0UzNBEf8F{$>TVosIxOQ4>`Z$%UHb(T7Nc}@f6D8w#d^pEu|Rp`>h
zD3Jp3K~rfWj>XqAd-bel7!Anc#ou{rou;Vkr6Rgy;dy-KR`Rj%_YO5wlG|#EHc|~+
zg60*_mMaG!c=7zttnt^OkazDl-x(lVze+fL5de7~u*k=4*}LZ|5WYNXMCJc;Pi8vg
z4$@jVsBSwP{3zF|{d3z9j!z~b9!$R%;w3^x&{jIplHXE9L5OK*`I^=IiPe00e^o~A&8b|FLNmiFjSYL!vt;Wxqw3Wl4YUT_j;%fiq4ZJ~rmR|bhEh8Fr}b!!
z2R7E<-chU&6Z?Cb@?TWw_3Wa?g=Bx!$-UJ&@Hi#pJHu}u!5lD;XVTQXZ)R{IBwHie
z1WL&id&|(-Un=@KsChD)&#W-Ya$DgNXvhEf$De9d>tli%r3*nW#7o#|5?^1YHVAQG
zq+`Nu%eNj3O%If;-`+`L|9h}txp(&Hx|g&p6U2XQ>~s{RrpK4|e~;rpYcAR*bGGxT
z1+KHEff3a^ExZew%`^Efjk_i&*BR@Q-H6)EEpAa%eWVeXEU7pOft-Z?_U4r(Fj3|P
zuioEX&BneSDoacFF{Hn**I;U3F&?7()`4bicfpt!q<4$>_w~88n?jFCt985mKB$KI
zoAG-VUjL$Eg1La{G1o5%km(@J@b|d?kFl=|tE$`DrX(Z<1?fhmL%O6JRFqEX?oI^>
zk?vM0m2Qyk2I-KlO~(c{v0?MAjd;%cyyraM`~30J3oh4ObIfs%d)#BJF^4d*?qbfh
z-zF+f3U;GfBouz93=Z?EKaNb`Wui^uC
ze8kLbL(n;U9Ef~Cch&Fj(MI7n3q51F9i|9Jq(RFNUb8oEXMrg?jve$(F-;J!aU3^w
zw(oH<;{%;8K=_h(nbWqdVOp{uwu%z7WQH5xOmv&;)1z=bQ``k>Ed~niV>Z}DO{r~?
z&wp8vgZ|@s!I^bMgabJbrwzg5#5urOP;SBV_70T)v7W{8=N`Z?J#ec22`7b&sAr~j
zsyzIW0xapTX9__ueAs%%Z%|st2Sx?%K(D#Cd3$@gx2>DB&MV>5NUnS~2X!558uhfa
zxSFgafRAi+)eFlfuEI?EOxmX+SJQ_nT^+}2Fd)8LoNE(ieia;0>8lX|b&9Vs7Aq!DD%u>eq5nXv&)oH~L4>`-aI)K~#k|DHt;tdBN3x@iaFeKQFv
zGTpn|p5Wg%u!Q{E+IfR4=Q6t#9doS{3S4pi_RFMgJ|
zX~Gyic7e|kjP||4T_PsKimwWV#;%Fa&B0HBK`(+?Nc+l}a|`+<+m_`?
zyDu;VDDQZOW`;j$0RGKlb_UE#64s{$#I<)%HAIQI5gNVnxDcBk-5#9V`)_WmCbqH&
zX-HXH%Xj1pmJfBw*@+l
zR7d;O5K#Wj%)Y{jopcE37LujJ-6uS6!c5~um|LVAv|oO|c@35A7QcnL+gZu~W*mGc
zMLH$wMfE$LD;(inRBdDCK-qpAgr@Sac1nY{U*vYz3BP~0S_LMel?I5YA|xqtf4a0>
zv-Cn=r~2vtGC&@iS+!Jj$@e->z1zv-x~!2lUfJfIj08x1o-858XZ&iEN;DoiNe+za
zoOT9giaxujwM*>g<>j+O_|bD+sJ4lK^dCOLAZ>YI#*{TIDQS81Sc8K9_daB@rgzcaqq?)%WcZ;n#%L
zG`#xWrJ7kzy83gn(#6H~Apdj0Hyp9=Z4y>?D~f&-PVgOs_gi(7dG6z#?@0sZ=Jl}h
z`$}|Bh6)cFf4{t)L5Il_RS6Z=(4ez)2Ht0
zrD2F2!~LAchBh6xS(;~TC*|nXXF0S9Oq7iN>69G1n=cX67o8QZJirNjG;5HX2@E%l
z(wtRebX5BcXvY}dUIE=}+5oR`SiT+0iqZ@~=#$$7Z#@X5dDG!)MC<%yyqY-Dig^gu
zat`h|eq(gAxL+;Tmr)=@v)bP)OZSSHJLZD@SX$MZjjT9+)EpTr_8VTA?I^
zyY4=|QqUzxY+k(3)O4KUAh-!GzINBdAun>XOwt5Cx{USp<#{bX+*=vblrxb`^-|xu
zL0_NY#8zfA1;0mM^YPj-1QDTI!1nPy{-$mZmZQ0V${N$VQ<
zV$>l#$5-#7Hn|rY=<1jP3oY*4&LC5yi*40c$A0S~YuF_G)@(@Mn3-*K#}>Vy%Val5
z$+3;{;$fdkHHkbL|Evpe>o^)*RJCJ_1OGt%rYG_WOvoK#P0Z9rI4SS5`HGmYN-?`q
zQW{&6aooj((_#_jiOU2sg8$CqmJLm!wZl9DU8oaJ*kw09mEPZak8%Y+zZ)lUvWxo$i
zr*k?fOP@Nb0b|n)JB11OX80eDoohCE2Y%EVWnLrblJ|{O25?WpRKaEX6>(+#v|g^~
z`t#)1CQTJ>KEU_P-hNe5t3vt4bDmwCR(
zDeb4)eS&!4cRqCe+O`oE>1wApdg)%j4GBj6rH^$hpmJf@@IAa5e$;uusyb$`C1EKV
zw>L}Q)UZMURI}EBfvV|RUBM#y>Y3$Mj7+0K*S-3EABrdWxQDO+*Y6P(Wisgzq%}UU
z3NTS~D8G+I%=lT<>}$Lxa;N<8#b-|I24S)9W;k&#IzCSp78Z{D{OKPOLcHgZswX9iwlCc|jSujsX=wY2%Nk
z`9yQhT6Ac#LQ%*v40@ORg$EyHICyle1;;KwChhV!0^WaaP`i2xgN5v|~8
zp7=z$d8oPHH~xnUr{bBRLhCF2I6Dm@Q`f}&I+^@K$PunMsBVD1TtfZ+rLbAxXkYb9
zQ*6!0{BnTHoU;&y~R1R0yw~hdB1Fs@+S)uPrFp&^iD;Mb%r8mFsJN7l9VLG
zwoAhjt!LOKJu=xGEHi!KHWU`MqQB0%$7ul*Pd?Vl`1os#`DG$o7MP(syEMRL)|33A
zRt&sQs;81cDxwgK*MY&*jW)}IitL-?}zx9D})H!TPs4a`9?
zsbM)}xGQGO$Sdo_k1+AcZEpEHtBIe8PbyHFQ3>B}ryW8b{1c+?1NSaQqh&laz}i`U
z5wKw4w657j?P;CUpvL>aCfE`S_Kj{Qpn;8mT{D$`|cf)N@S
z5Gi244y%T4gTD+F`M~1EI>F0_z|h6CnB_JID9yrx64drS`2Z*K|65Gg!xrbp<0c<!%=$g0|8>l89
z3IL=1lr1*t|81&koAhpd2tY=V3>HG4Bg_t64@qu_{dYe!RKf9w^M9AH{P3f9&a(4e
z7^jcN4YOR%%mIf4jCMfE7S5Hh`8wEPVku3@q_v3nFxAF>@tJ0qhpE}Q(dF>M3?cXp+>hJIVM&&We
zeEQUo!3N^ryiqPNM2rMJc@aM7$#J@4viBR%@(bzhE2^#*wV7qC3(mEe(@-X9P;5N6
zTPW=te$M?s_-USZiO|wYAu4fpXW1jP=I>A+j(CDdAzVJe-{KUn>O&sO0*65t;k;=2Y3AyAK@>?uRZydq+b$s7
zy8rj&sZ9~vUqOwxPw+a0#w^3N%Hh|Np8dQDr$@hfBeD+mackds#~N>U2yZUh2$ROC
z*_2i6&Vhh;s_(eb8%EIw5a9dHCVe(hK>$PQMV$A!Fs@sWa;0xW`}^v7uZ4$W9h}3T
zMx-Qku$`1lWK@IMiUggfo^*(k#8KEN0`C|q>Ge8)j=zXR6FtuGz}0}VT%
z7S~{-u0pHk=0u<^`G{=@OHoT@;?uvN=ql@*unQ&+p+F8@P*Ag<-zImR(3N^-b(*y^
zx*2)zwDz@o{objY+;oOxUN(IG%I(QbWduzZ*zLG6AfS8{ak}882hK42eQABiuLg{@uO
zye@;Fv$1x$+Gv^D092J4HyXRu(<86Vrw!ipfD#&!)`
zW`MJ=#zocAksz2!?3*S^A{%5N0=*)&l1rt}5iT7H0r~olx3SN{u@|qfAj}r;<)6;K
z|0N*+A7jnVJ%{X2rm^WOvhgJBa%&?k*4g^;l^l!#{Q&9X6!kN)ldo)Vj`HtsYi1S2
zGV}6>#<}0S4F8Lx=A5l`M`wZ07GQ?VyeaB1$mz?MKSrO>JDq#(dKz6Boe!^CC}Sk6
ze35u&*2|Ta^(PFPmam&X4uQrgpk*gf+7X@`0!dnP>#Z#I`!ZU|KO#F93j%yJB+%IN
z`c&$)=T+6DH89A^;;RADVv+L0S`9e9awL#PUN9R1Ii%)qy(m?Vj%3}!Zm*<(GvYmb0#@ZF3Co}8r*c-M-HMyL%S7bZ|_?DBPI4%AZQ@-k5(;n
zCn7Dv?{*N$Y#h)yb(Te#eZAWN_al~>Cz#+bB>55&2iZ--rs6BN_2cnv@e6J2f{WbjB1oPQob5}Rn-B%;_t06)M
z?FcKr?VPHf{4#=QT)V)4Cjb7mql@S0ryduXwg|#e`ql*Jr`Us}8;5@r*^00c)0q%U
zMEcGEM)~nXIT5AV6thWy89v$5==|^k7>s=&w21Y)#d=mz+{+n6{c|{3@k>K0TO*{p?3;PMs{DF+rE#5(?-fg@PiPKK
zWI6_rZ{9A~Bw`fP>82F(UZZ**a=IT5Q2dSIzgceXon|M7qD0k3pA?`+$sHKr7*WS-
zl8f35|NKX@x~5kH7h0Vzn=rc0lXq+3dE3bwA73s$=h#WdKortE13o+gz
z&VoG|dMF33Mr8N(0usm{%i>a`Ey!!gh4hYrIPh!Il2+_9R#9mQWQ2A|_De+q=ZCny
zYs7kVJeR}jYhy4%m8Lo1CkK94Y<`THzBRJ);8fui!6|7(z8b?P=5geKI>q)h9D8VF
zlso*W_!Vg`@-Z@cCms^+p@{EKHhiiPAe!~ARfLSb5Z4;#V>?iZ=)Wnz7dxGg45{K
z<3J@r*fdnKH19MgjhKWdjvjh%nB*gbgf5RhxFZz-EA>n{$jp6dNAwaZ8k0jTD13Fy
z88Tp`f29FCqP!wfxqf4Ey{>=#ww~SFdUhXK0g&^@
zW!*p2=TLDm>yGkvyaVcl%j@_Yhk=1?_rHMLopqje5LvO3X9s
zRrKpI0s&wP4jQe1VZDIWiq#VL`~IbQj0s|pyIgT6E|jm)V~<3%*-qzu{F+SdFSz^9
ze6}l}II^F9Fsol4c#IHSeWlI%?JBjQ^}|>V<-uY~X5xzZN$sJ${%I+>IdrSKvABKV
zIrJ_rij9qprVg`b(?j=|Jny(c#l555>7m-&Jhm(Q~V<)E{AV~DE
zI`r&*dPel-lhuyal8?tl4NxP_BO)#jztbJ`A$Q3(b^=#e%o<}P0S2?`)w&mf(CGca
zsP$R$I`Yirfaf;s^S>TZ2S%My7xog)TP_;~BXb6NG>jC5fzHhWslyh`rtJ4?ZL<&*
z(WwL5L(H+Iy|80O&4+o=4W^F-@%#
zs%3I}MkAY8uk9xrdh1c%gt+-ZC$B#Zik_7lTJnJUpX9$1_(JbLVqWodH}^D-4mX)x$lnwyye4tg)QdAVvZy%32Lri
zm3G5FOlPp~Ec6k_JSDODH1PYNOCpHVn=ZeRE=nxnjS4b}Ct}tmK1wbv#q*~mgM73e
z`ju*5?#qpKH=H
zS1aJWSWo^t=16A^n^zd$ZU6yBe|JZ}4%^$}rXb=@O66pR#QY+G&m9To7|nPhU4F;k
z?#HKnxDe?aMuEa$m(h=eM<0e7uCtrsb&-CaG5Auc0=Q5>7im1rb$v5G6&=o5Q$)yR
zML$24#NGc67sKXHNm!_fJcfE&B2?B1nHpQJdEzSHc?`0
z9_0lS4CdRuZK?B^0`P5uQn&$#$)t7g&Ut0hkj0n%iN_(#i{#;eFL3^MUkHc4a*wI6
zUPRV7hyg#5RsEZfPJ?9QTXyE_v{H5jE!%l#@sH%gdPoSA(`ELNXq@mvXi(dfhP*f{Rc9qSlyD^d^JHzzVl5{1H*
z*1HyCvF%oUbbfx(uXy;o03g7BX9$vnoh3OvlTC{<5q2~nJV*>Z>=i>r{|9Dq&pUHY
z7P{!~%Rth9ioLu9kBj#>2?5vO!RGqTQ7$m=zi|x-jul=Z`_{4D*u?O8X7O3|&@;ov
z`;$-Q4D5bn@0#O3>51DE+{!NXj?Xq$3vo`6>m1X?|5_Zi_C)jL-mDA|1!3pAn$e=d
zOJsQXGTsdutA2$1XvVUO{}rB}k^okuPrU`9VgtzT1o|MI2J~Uun+f4-U$8xv)O}yg53|+he7k$$M9G4g_
zmvj{7(~k|V
zu_gH@8;MfR!&R>KRkH@ZPHdXvTpPixA8`i;cbjLZe&AG@e<c*wLSJ-?G!ffox*tJM8t>zkwyVU&IVt)|1KP4~6rhiX)6c
zj$|_8(1L|mJO+!!KI%32s*XYKG|o>ww#!z0&J{5S=^kb4v}QOq7)&D%DZ9Q3nH+!k
z{0l%GfJ6Ced7tr#T`4Z|wwYkLH_Pd_TKumA@te~SSaW>-sEI=1g*;$$#2RQtx0^CQ
zT3|ad)NaZPQKfc^FDkopADF^(s#E;}fdM$YZzL;Fvl>u)EZ|mG;5j;SBr6o*&3O3u
z@DyNWvEkZoU+KdQ0Ya1DSHG{GF?qoe(tN;_!u6IGQK7)F)Be2nsLTV(nj8h0_Rm)N
z1%OF5m%O+eJL;PWw=bbhRIfXnXRFUFGuUA-#Z5dOQD`VNohy=CkFxX3uF5@
z4BfxRZKj|$gG8Tq5YCW
z7ic4(#>myhuVWz}Ae&w7)BxGcyCIv6=i6_hGvncVNu6gmUGBfoxC-oL$3NIhy=LnP
zN|CdWyc&S`PS~}S5>T6gmUUkASX362B~nI{BqWIVeI7aFhSfON%IkR=rJ2prR+g?j
z(sE(EaC#P8c7`bq5EIKAVv>5TNeA9`1o=ntt!*Avp?ep$IZ(-k{!K6kY?@&Ghqd~f
zq=+VQ4yewCwP#RrPb4CQ5Vs~hnWY@QcPLfA@*w*j^xU&U7$15uCz=3Ya)jNmA(g4m
zqua+@+&n(>+EZt>)M*fr+Cko>js>CV`4X@T?f+mGDEMA@%d-gX&>y@n2auKudyRKAhw*nAK2z_XC15N%zbh83e_e1Nx0z(Z2Z!^@Tz(TS{l
zz;WOx)TO!ZGK>aV7ys!JipF`njfTPx?w^YjOKSI%?Xg|mqb*f*d?9zef~OQg!M0WY
z^P+FzN{?0do1-_$Lsaq0-R**XcRFALf^Rl}<1A4|Qm<(P*Z@$rRxx7|pouJAo5?OC
z`~wGRS${Q6d_Jf`d2s(id^&EkJf}Rr?=Z*D+1a&MX4KR(h+vSgSY!7LKl7DNL0snL
zy2DUSaQR!p8fw_Ob#HvJ?>01JN$SnMavFZTW>0_=fTOs(u>c{y9QDv%&7>eCb^~%4
zI>fU8S{hMS7aZA_|2+-(OPmp$vYtx@Jvn~Q*-s&?<34+6Xz-Xx^pV^3C2z*k`?5ny
zA4cGAmk72)8J{+n^SN@EnT8eVS8w>~pz#r6tDPf)JBj)4Q@YOT#j}Q%NRB3s?>}U<
z<5|bTPv}C8`VSaGfKq2Gvq~vj+|_yyDEkM);u$;ptffsn;EtX_M7x@W*;Goho>!WJi`;JmA#LscYh9Iig7rV|Cn5da-ZVRxIa9{6$m66CUauazrE
z49~=V(`CP+ieE_fo|P-lWZ#t(3>MWfop;B+`UhkUhheJC4O~H-(W?KrO;NXhirjpn
zU}1+??{PrQ-DqyT7K+BHKDcLS_@OMm#q&!n98}giBm$Umz#N_RG)08s3$fv0uuW0w!;{N!aiMVp6LR>PseobN6=2G2PEVmgk>5H?@(u
z?((;%5l@BhT?ml!XC(Ru$-<7AvV>R2Lr+|a*I*x-YH&{<)%}Ly+Y^>GP~~6sZVpxM
z`5w!I^EPpiKb_D&I$ruH22&YVXylZrK~^W&;3+3sp|-mwL*Zn!z*rQ%#$%K(;P7=q
z&|}Ez-c(`23&;mII*4>HO0CCs!iu)>vHImz7u1&?ic3k1zsv??Nq@`^(T=3X^Dp0q
zpZSjg%H%L}gX;x3RE&Ru2d1wFQB|nf)3A?4ntdK9z*CWm>S{q?F^68zwjR#I(M`4F
zR~@g$m_^<6d|}@uGCa$Q?*##0yx3ohA-#HsFfO4RYgO
zTU(agS)5afK&Hl!oo1<{h%9s_lWkr8znQS$lmVOm&gM4#U0`A1c;rx8q{;EgJ|IpA
zUE!MH$%V-)^NXBxvLIO9=n<{68P)2$ltRzB0_T25t5E4d^PxecWWz#pd)W}*h~*{%!`ltC3mICZR|>HrrA{NG&QDQXt*+jt|X=Et>%H0(ArRimnD
zM@FZYV8ipvu=ke4O9ozGS7%rG*Dm2&0wjGLUgs-aaNs%HQOZWLXNPuVwZ%W%HNgvS
z*dsx-wwfiy*>I`cR)T~HS+NS?`GR{s4`Mfm5RC*kpr%z@d&50jf(S&qh@DQRlI9K{h
zPRu=bAZ2?~<;%kx9WiupheVrQaAAuNFQ&O-f$-dqk`TzLy57=}{Z=68s7V5bfd`>)
zDm?`>HT)zh0denR{LSTol2bMa1&$2O-RAvl--2cGC-?oKXgB}qmC4L&ZGV*m
zK%D9pQ9G{#Be!$W9P@Gsbwo&)uTs)(F~Vr(+X=A+l3q-Bb?&iC|(zUU|t1W
zo4y9@0m??sfD_t2NBHr*-)dM4UU-W+@ZSa=Gmrop>0QOdqE|fxZ1w9;Ca|j-PFjp>
zhi8}Dp9+Q2AQ)w?9uYC7Yd`~#?5{&=fzj~vYw9y;$kCl6K&D*~B`y59p-K^aN+f3z
z>jcPCbbB6sTdmiT5;S9ea%G32$|2raKq$qK5Wm|T^7KY>km#VH2gJo2N`d_#EDkOX
z%6_U+)+0|{elmp}WN5cMWI9w1<^wl4h|!=oCk@ZqHw=fC`T;K&`P|07`Ip%mYjTEw
z{LAv~os}5HdqE@xlX?rJ{P?A<
zp7&ds7uN=}Fy*jrgO2tX3S4|Pe!Q4BL@IxCF1nw!iSY8_sep`G)t2)U?TMJ6a3ueA
z1d&%yy!PNeWJWlBq{{%D4VkYze2cpT<=$2kJPp0g_P9nQ3XapXeT7?dHF5@{6~bB6eS~rQs?pG6r<^=WL^o
z_6K?8zR}{3ko)^zEcCA?PR9!teq4Ay;(>`>_6?;co-*V-xvp;wt(sf|vBy3Vs?xgwF&K(J{h!l)#Jn8w*l|IJ#z0y0-+3sfM*XS+94JUeIW+)O=
z9sMgaR>-Nmcsc-3ea$IElfd$|pW-TWZ8NO}l*7>B=4XgCegI0nu*eKTAkz^2mAs}+
z&#&r4|2);p%=KW)dHQ93BO_u>;lRbfXSi0RGec|kW0k4P)++-@(OdR}$LX(OU)?jZ
zIwJpCNyw%=+dK*a-#Fxm{uJl}g@IE*ab^ujmbp>i)l(m;eC6pjdjp)R=!0_3
z=q6TI9CW#tzS^u{72L22+&v?~(7$FRn`pilLcgu+6YRrEEs^@%Ch8`6pqq8lT4lZ4
zOxN?I$z%x0w|vBb%Hgjn^)a%j4+R=LosI7
zDs&x!D{^gF(Z42y@C_o3YuT7!uqfyfG3ik;T4L1Hn_4BqW-e6vd{pAtWj)Q`eO>S|
znD6*gj+|EQ7Y1r$gixqRA|C#0@k+5OxBwe{5dJ2bGEo36kdDKJyb9s6-=phoJN;j{
z-w5vIu?GkF$0C-fkD&cnFA5TdND)p&iu!9}xjC)1w6O{~-z{Cog)~l3jVz(of-K`Vz)+_XH;HsLWy&e?nxG&8hf>q
z-Nm`OF^+b*Ot_wo&Re>i4L|u0P+*ZUX(S-_yMd7sahosnl*+i)M0)s^$neFx5%8*k
z9j9Xeyu%uvC($hV5rtlYKLQ{Yb2LG(jl$Zn#uru7_8st6HnYG(LCw>Yg9uPBK
zaqZ%N#V6*F^DXDuh;IyyV1VLd+roYRy2=Hl5}6B$<><~RhvpLzvv<`zcQRYHT?WhR
zXKPl%!PYK~smI^2FsOT!bs)8YQAzi{W0&0&1_DKeslmVCQV3n%QB}97ATyYB;=Jas
z1QQN?@Z~=;?cCaqfXQzHNfZE=kTygwDJZ
z?pO02Ze^@l50kSIxTW;3&?Lhuo%uf$t2>(XUk%Cj#yurI`q>t<-0$5;+o)xcep>cX
zQ;S+Si%18dXf}nhZJ(0<+qbL&p%fMwmoy(xPBnrx)ULy0R>R`}R$5j+%eWn*SUdC;
zb3}{E!YxlugvQ4tF4AMlJ;#sfEkDA41d1xw>0Q)n^R6q|U{yal`KehxdO;b>ZHtSAd#D9q4Of8SP|@fVh8;#apc#+(q7kyZq$|s#YM8
zKV_6U!%)J<EyrLO9sGFq)IrY|d!a
z3k2*%!KI3vzMN`RdPPh3_Aeuk(1eTJ{i8?r?5f~nAnX+F&_IL+|?-L4^T)8hGa
zARnJkmpS>pUESBG|0Y^Pi~8;W>43cSz9}2pEW>#$rE8#Yh&Kek_h7s6p2gf7hnWzx
zRZ_0qv-bqp`)PGtT+W7i@1I(Vjeb&3V^ZtMqIIM<@L|cwGUHe82FrNnj(6f!c8St1
zJSGRh{g4A<-`^Fb?*U|KM$;qe6X!BZjir>U{noo*|u=cqJpc_$%M3
zDBFXBCK=rtf=EGeKFI|%x~%)4=m|4AsV+0q4_MbTkEdT+rHfyA^z;(xtc$IhYz~GA
zo|7{A0HvEqI4ZgR8Wa1urVdn0m7DV-`sn$9OvN5-av1edUm-n1)SS|V)n
zEvB)NmQ$g)%~}*^c0`QO#
zf=bscsz`nxQ5Fq0X#=BbcAPM%IcQ&z8sAj^F|IF5x>F&2Y}67TLgqXKTEbPCoja0HAFnLoM%!hGjZNOxCf$8c*f=f*!dplzMRrH*W0<8kylGQ
zwfU{wC;VS)^DqG3?AUn|+7b{CNbZIyp>(@WtOq{|VA$h1I*7QBUBq
zTo7J